Universal SSL: How It Scales
Oct 2, 2014Nick Sullivan
Summary
This post details the technical advancements enabling Cloudflare's Universal SSL, which scaled HTTPS adoption to millions of sites. It highlights the use of modern hardware with cryptographic instructions (AES-NI, CLMUL), modern cryptographic algorithms (ECDSA, ECDHE) for faster handshakes, session resumption techniques (session tickets and IDs) for returning visitors, and lazy loading of certificates to manage dynamic configurations at scale. These optimizations reduced the CPU cost of SSL to near zero, making widespread HTTPS deployment feasible.
More from the Website Security & Threat Management trail
- We tested our own WAF with frontier AI models. Here’s what we found
- When scanners miss the attack: how Cloudflare Client-Side Security protects storefronts
- Introducing automatic remediation policies with Cloudflare CASB
- Introducing context-aware vulnerability discovery and remediation with Cloudflare Managed Defense and OpenAI Daybreak Models
- Introducing Adaptive Intelligence: undermining the economics of every bot attack