Skip to content
ENExplore Calculators

SSL Offload Capacity Calculator

Size SSL/TLS offload cores separately for asymmetric handshakes and symmetric bulk encryption, including session resumption.

About SSL Offload Capacity Calculator

TLS costs are two separate things: one expensive asymmetric operation per new handshake, and cheap symmetric encryption on every byte. Sizing them separately shows which one is actually the constraint, and session resumption removes the asymmetric cost from most connections. Moving from RSA-2048 to ECDSA P-256 cuts the asymmetric cost by more than an order of magnitude, which is often the difference between needing an offload appliance and not.

Formulas

SSL Offload Capacity

cores = full handshakes per second ÷ signing operations per core + bulk throughput ÷ AES throughput per core, where full handshakes = total × (1 − resumption rate).

opsPerCore
≈1500/s for RSA-2048, 240/s for RSA-4096, 25000/s for ECDSA P-256
bulkCores
Symmetric AES-GCM work, which scales with bytes not connections

Effect of session resumption

Resumed handshakes skip the asymmetric operation entirely, so only (1 − resumption rate) of connections consume signing capacity.

Worked example

With the default values below, SSL Offload Capacity Calculator returns Total Cores Required of 2.76. Change any input above and every figure here is recalculated in your browser.

Inputs used

TLS handshakes per secondaccepts 1–5,000,000 handshakes/s
6,000 handshakes/s
Certificate key typeone of RSA 2048, RSA 4096, ECDSA P-256, ECDSA P-384
ECDSA P-256
Handshakes resumed from a session ticketaccepts 0–100 %
60 %
CPU cores available for TLSaccepts 1–512 cores
16 cores
Encrypted bulk throughputaccepts 1–4,000,000 Mbps
8,000 Mbps
AES-GCM throughput per coreaccepts 0.1–100 Gbps
3 Gbps

Results

Total Cores Required
2.76
Full Handshakes per Second
2,400
Cores for Asymmetric Handshakes
0.10
Cores for Bulk Encryption
2.67
CPU Utilisation
17.3%
Signing Operations per Core
25,000 ops/s

Step by step

  1. 1Values used
  2. 2SSL Offload Capacity
  3. 3Effect of session resumption
  4. 4Total Cores Required= 2.76
  5. 5Full Handshakes per Second= 2,400
  6. 6Cores for Asymmetric Handshakes= 0.10
  7. 7Cores for Bulk Encryption= 2.67
  8. 8CPU Utilisation= 17.3
  9. 9Signing Operations per Core= 25,000 ops/s

Assumptions and limits

  • The result is derived only from the 6 inputs listed above. Anything not among them is not part of the calculation.
  • In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
  • Figures are rounded for display to 2 decimal places, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

How is SSL Offload Capacity calculated?

cores = full handshakes per second ÷ signing operations per core + bulk throughput ÷ AES throughput per core, where full handshakes = total × (1 − resumption rate). TLS costs are two separate things: one expensive asymmetric operation per new handshake, and cheap symmetric encryption on every byte. Sizing them separately shows which one is actually the constraint, and session resumption removes the asymmetric cost from most connections.

Why does SSL Offload Capacity matter?

Moving from RSA-2048 to ECDSA P-256 cuts the asymmetric cost by more than an order of magnitude, which is often the difference between needing an offload appliance and not.

What values do I need to enter?

This calculator takes 6 inputs: TLS handshakes per second, Certificate key type, Handshakes resumed from a session ticket, CPU cores available for TLS, Encrypted bulk throughput, AES-GCM throughput per core. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Related Calculators

SSL Offload Capacity Calculator | Calcrivo