--- title: "API Gateway TLS Performance: Handshakes, Session Reuse, and Measurement - API7.ai" description: "Reduce API gateway TLS overhead by measuring handshakes, reusing connections, validating session resumption, and testing safe protocol choices." url: "https://api7.ai/learning-center/api-gateway-guide/api-gateway-tls-performance" --- [Skip to article](#column-content) Column contentsAPI Gateway Guide [API Gateway Guide](https://api7.ai/learning-center/api-gateway-guide) Search this column 01 Gateway Fundamentals [View this topic · 10](https://api7.ai/learning-center/api-gateway-guide?topic=fundamentals)[1. What Is an API Gateway? API Gateway Software and Use Cases](https://api7.ai/learning-center/api-gateway-guide/what-is-an-api-gateway)[2. Why Do Modern Architectures Need an API Gateway?](https://api7.ai/learning-center/api-gateway-guide/why-do-modern-architectures-need-api-gateway)[3. Reverse Proxy vs Load Balancer vs API Gateway](https://api7.ai/learning-center/api-gateway-guide/api-gateway-vs-reverse-proxy-vs-load-balancer)[4. API Gateway and Microservices: Decoupling and Traffic Management](https://api7.ai/learning-center/api-gateway-guide/api-gateway-and-microservices)[5. Understanding Core API Gateway Features](https://api7.ai/learning-center/api-gateway-guide/core-api-gateway-features)[6. Open Source vs. Commercial API Gateways: How to Choose the Right One?](https://api7.ai/learning-center/api-gateway-guide/open-source-vs-commercial-api-gateway)[7. API Gateway vs Service Mesh: How to Choose?](https://api7.ai/learning-center/api-gateway-guide/api-gateway-vs-service-mesh)[8. Envoy vs NGINX, Java, and Go for API Gateways](https://api7.ai/learning-center/api-gateway-guide/nginx-vs-envoy-vs-java-vs-go)[9. Core Concepts of API Gateway: Service, Route, Upstream, Plugin, and Consumer](https://api7.ai/learning-center/api-gateway-guide/core-concepts-of-api-gateway)[10. API Gateway Comparison: Apache APISIX vs. Kong vs. Traefik vs. KrakenD vs. Tyk](https://api7.ai/learning-center/api-gateway-guide/api-gateway-comparison-apisix-kong-traefik-krakend-tyk) 02 Gateway Architecture and Design [View this topic · 10](https://api7.ai/learning-center/api-gateway-guide?topic=architecture)[11. Deep Dive into API Gateway Architecture: Core Components and Design Principles](https://api7.ai/learning-center/api-gateway-guide/api-gateway-architecture)[12. Choosing the Right API Gateway for Your Architecture](https://api7.ai/learning-center/api-gateway-guide/api-gateway-monolithic-vs-microservices)[13. How to Architect an API Gateway for High Availability (HA)?](https://api7.ai/learning-center/api-gateway-guide/api-gateway-high-availability)[14. API Gateway Plugin Architecture: How to Extend and Customize Your API Gateway](https://api7.ai/learning-center/api-gateway-guide/api-gateway-plugin-system)[15. How Event-Driven Architecture (EDA) Works with API Gateway?](https://api7.ai/learning-center/api-gateway-guide/api-gateway-event-driven-architecture)[16. API Gateway Request Lifecycle Explained](https://api7.ai/learning-center/api-gateway-guide/api-gateway-request-lifecycle-explained)[17. Cloud-Native API Gateway on Kubernetes](https://api7.ai/learning-center/api-gateway-guide/cloud-native-api-gateway-kubernetes)[18. API Gateway Control Plane vs. Data Plane](https://api7.ai/learning-center/api-gateway-guide/api-gateway-control-plane-vs-data-plane)[19. How API Gateways Work with GitOps: Automating API Management](https://api7.ai/learning-center/api-gateway-guide/api-gateway-gitops-integration)[20. How to Perform A/B Testing and Canary Releases with an API Gateway](https://api7.ai/learning-center/api-gateway-guide/ab-testing-canary-release-api-gateway) 03 Gateway Setup and Traffic Handling [View this topic · 10](https://api7.ai/learning-center/api-gateway-guide?topic=traffic-protocols)[21. How to Deploy an API Gateway on Kubernetes: Step-by-Step Guide for Engineers](https://api7.ai/learning-center/api-gateway-guide/deploy-api-gateway-on-kubernetes)[22. Hands-on Setup with Apache APISIX API Gateway](https://api7.ai/learning-center/api-gateway-guide/api-gateway-getting-started-guide)[23. API Gateway Auth: OAuth 2.0, JWT & OIDC with APISIX](https://api7.ai/learning-center/api-gateway-guide/api-gateway-authentication-apache-apisix-oauth-jwt-oidc)[24. Mastering Traffic Control: Efficiently Managing API Requests with Gateways](https://api7.ai/learning-center/api-gateway-guide/api-gateway-traffic-control-strategies)[25. Building Reliable API Gateways with Logging and Monitoring](https://api7.ai/learning-center/api-gateway-guide/api-gateway-logging-monitoring-best-practices)[26. Dynamic Routing in API Gateways: Best Practices for Flexible Traffic Management](https://api7.ai/learning-center/api-gateway-guide/api-gateway-dynamic-routing-management)[27. How API Gateways Support WebSocket](https://api7.ai/learning-center/api-gateway-guide/how-api-gateways-support-websocket)[28. API Gateway for GraphQL: Security, Cost, and Caching](https://api7.ai/learning-center/api-gateway-guide/api-gateway-handle-graphql)[29. How API Gateways Handle HTTP/3 QUIC Requests](https://api7.ai/learning-center/api-gateway-guide/api-gateway-http3-quic)[30. How API Gateways Handle MQTT Requests](https://api7.ai/learning-center/api-gateway-guide/api-gateway-mqtt) 04 Gateway Integrations, AI, and MCP [View this topic · 10](https://api7.ai/learning-center/api-gateway-guide?topic=ai-mcp)[31. How API Gateways Handle gRPC Requests](https://api7.ai/learning-center/api-gateway-guide/api-gateway-grpc-support)[32. How API Gateways Implement Custom Plugins](https://api7.ai/learning-center/api-gateway-guide/api-gateway-custom-plugins)[33. How API Gateways Integrate with Kafka](https://api7.ai/learning-center/api-gateway-guide/api-gateway-kafka-integration)[34. How to Implement API Aggregation in API Gateways](https://api7.ai/learning-center/api-gateway-guide/api-gateway-api-aggregation)[35. How API Gateways Enable Serverless Architecture](https://api7.ai/learning-center/api-gateway-guide/api-gateway-serverless-architecture)[36. How API Gateways Proxy LLM Requests](https://api7.ai/learning-center/api-gateway-guide/api-gateway-proxy-llm-requests)[37. How API Gateways Enhance MCP Servers](https://api7.ai/learning-center/api-gateway-guide/api-gateway-enhance-mcp-server)[38. MCP Gateway vs MCP Proxy vs AI Gateway vs API Gateway](https://api7.ai/learning-center/api-gateway-guide/ai-gateway-vs-mcp-gateway-vs-api-gateway)[39. What Is an AI Gateway? Architecture and Benefits](https://api7.ai/learning-center/api-gateway-guide/what-is-an-ai-gateway)[40. What Is an MCP Gateway? Architecture, Use Cases & How It Works (2026 Guide)](https://api7.ai/learning-center/api-gateway-guide/what-is-mcp-gateway) 05 Gateway Performance [View this topic · 10](https://api7.ai/learning-center/api-gateway-guide?topic=performance)[41. How API Gateway Reduces Latency: Performance Optimization Strategies](https://api7.ai/learning-center/api-gateway-guide/how-api-gateway-reduces-latency)[42. API Gateway Caching Strategy: Comprehensive Analysis and Implementation Guide](https://api7.ai/learning-center/api-gateway-guide/api-gateway-caching-strategy-analysis)[43. How to Optimize API Gateway Load Balancing: Advanced Strategies and Best Practices](https://api7.ai/learning-center/api-gateway-guide/how-to-optimize-api-gateway-load-balancing)[44. How API Gateway Efficiently Handles Large-Scale Traffic: Architecture and Strategies](https://api7.ai/learning-center/api-gateway-guide/how-api-gateway-handles-large-scale-traffic)[45. How to Improve API Gateway QoS: Traffic Classes, Capacity Protection, and SLOs](https://api7.ai/learning-center/api-gateway-guide/api-gateway-quality-of-service)[46. API Gateway Log Storage: Pipelines, Retention, Security, and Cost](https://api7.ai/learning-center/api-gateway-guide/api-gateway-log-storage)[47. API Gateway Timeouts and Retries: Safe Policies and APISIX Configuration](https://api7.ai/learning-center/api-gateway-guide/api-gateway-timeouts-retries)[48. API Gateway Concurrency Control: Capacity Budgets, Backpressure, and Load Shedding](https://api7.ai/learning-center/api-gateway-guide/api-gateway-concurrency-control)[49. Asynchronous API Gateway Patterns: Queues, Callbacks, and Performance Boundaries](https://api7.ai/learning-center/api-gateway-guide/asynchronous-api-gateway-patterns)[50. API Gateway TLS Performance: Handshakes, Session Reuse, and Measurement](https://api7.ai/learning-center/api-gateway-guide/api-gateway-tls-performance) 06 Gateway Security [View this topic · 10](https://api7.ai/learning-center/api-gateway-guide?topic=security)[51. DDoS Defense at the API Gateway: Layered Controls and Failure Planning](https://api7.ai/learning-center/api-gateway-guide/api-gateway-ddos-defense)[52. Distributed API Gateway Rate Limiting: Local vs Redis Counters and Accuracy Trade-offs](https://api7.ai/learning-center/api-gateway-guide/distributed-api-gateway-rate-limiting)[53. API Gateway IP Allowlist and Denylist Management: Trust, Proxies, and Operations](https://api7.ai/learning-center/api-gateway-guide/api-gateway-ip-allowlist-denylist-management)[54. API Gateway Security Scanning: What to Test and How to Operationalize Findings](https://api7.ai/learning-center/api-gateway-guide/api-gateway-security-scanning)[55. SQL Injection and XSS at the API Gateway: Detection Limits and Defense in Depth](https://api7.ai/learning-center/api-gateway-guide/sql-injection-xss-api-gateway)[56. API Access Log Auditing: Evidence, Integrity, Retention, and Review](https://api7.ai/learning-center/api-gateway-guide/api-access-log-auditing)[57. Preventing API Scraping and Abuse: Identity, Behavioral Signals, and Rate Controls](https://api7.ai/learning-center/api-gateway-guide/prevent-api-scraping-abuse)[58. API Gateway mTLS: Client Identity, Certificate Rotation, and APISIX Configuration](https://api7.ai/learning-center/api-gateway-guide/api-gateway-mtls)[59. Fine-Grained API Gateway Authorization: RBAC, ABAC, and External Policy Decisions](https://api7.ai/learning-center/api-gateway-guide/fine-grained-api-gateway-authorization)[60. API Gateway and WAF Reference Architecture: Ownership, Header Trust, and Failure Modes](https://api7.ai/learning-center/api-gateway-guide/api-gateway-waf-reference-architecture) 07 Gateway Ecosystem and Comparisons [View this topic · 10](https://api7.ai/learning-center/api-gateway-guide?topic=ecosystem)[61. Apache APISIX vs Kong: Migration, Operations, and Team Fit](https://api7.ai/learning-center/api-gateway-guide/apache-apisix-vs-kong)[62. Traefik vs Kong vs APISIX: A Reproducible API Gateway Benchmark Method](https://api7.ai/learning-center/api-gateway-guide/traefik-kong-apisix-benchmark-method)[63. Amazon API Gateway Explained: Deployment Models, Trade-offs, and Use Cases](https://api7.ai/learning-center/api-gateway-guide/amazon-api-gateway-explained)[64. API Gateway and Istio: Clear North-South and East-West Boundaries](https://api7.ai/learning-center/api-gateway-guide/api-gateway-istio)[65. API Gateway with NGINX: Layering, Ownership, and Migration Patterns](https://api7.ai/learning-center/api-gateway-guide/api-gateway-nginx)[66. API Gateway with Envoy: Deployment Patterns and Policy Ownership](https://api7.ai/learning-center/api-gateway-guide/api-gateway-envoy)[67. API Gateway with Cloudflare API Shield: Edge and Origin Security Boundaries](https://api7.ai/learning-center/api-gateway-guide/api-gateway-cloudflare-api-shield)[68. Apigee vs MuleSoft vs Amazon API Gateway: A Decision Framework](https://api7.ai/learning-center/api-gateway-guide/apigee-mulesoft-amazon-api-gateway)[69. Should an API Gateway Connect Directly to a Database? Patterns and Risks](https://api7.ai/learning-center/api-gateway-guide/api-gateway-database-access-patterns)[70. API Gateway Architecture for Large-Scale SaaS Platforms](https://api7.ai/learning-center/api-gateway-guide/api-gateway-large-scale-saas-architecture) 08 Industry Applications and Integrations [View this topic · 10](https://api7.ai/learning-center/api-gateway-guide?topic=applications)[71. API Gateway CI/CD: Validation, Promotion, and Safe Rollback](https://api7.ai/learning-center/api-gateway-guide/api-gateway-ci-cd)[72. API Gateways for AI and ML Inference: Traffic, Security, and Observability](https://api7.ai/learning-center/api-gateway-guide/api-gateways-ai-ml-inference)[73. API Gateway Architecture for Financial Services: Controls and Failure Boundaries](https://api7.ai/learning-center/api-gateway-guide/api-gateway-financial-services)[74. API Gateway Architecture for E-Commerce: Checkout Reliability and Traffic Peaks](https://api7.ai/learning-center/api-gateway-guide/api-gateway-ecommerce)[75. API Gateways for Mobile Applications: Authentication, Payloads, and Versioning](https://api7.ai/learning-center/api-gateway-guide/api-gateways-mobile-applications)[76. API Gateways for Web3 Applications: RPC Traffic, Identity, and Abuse Controls](https://api7.ai/learning-center/api-gateway-guide/api-gateways-web3-applications)[77. OpenAPI-Driven API Gateway Operations: Import, Validation, and Drift Control](https://api7.ai/learning-center/api-gateway-guide/openapi-driven-api-gateway-operations)[78. gRPC-Web and gRPC Transcoding Through an API Gateway](https://api7.ai/learning-center/api-gateway-guide/grpc-web-grpc-transcoding-api-gateway)[79. API Gateway Pricing and Cost Optimization: A Workload-Based Model](https://api7.ai/learning-center/api-gateway-guide/api-gateway-pricing-cost-optimization)[80. Evaluating API Gateway Directions: Evidence and Architectural Impact](https://api7.ai/learning-center/api-gateway-guide/api-gateway-trends) 09 Advanced Gateway Applications [View this topic · 10](https://api7.ai/learning-center/api-gateway-guide?topic=operations)[81. API Gateways in Zero Trust Architecture: Identity, Policy, and Limits](https://api7.ai/learning-center/api-gateway-guide/api-gateways-zero-trust-architecture)[82. API Gateway Log Analytics: Correlation, Queries, and Operational Signals](https://api7.ai/learning-center/api-gateway-guide/api-gateway-log-analytics)[83. From API Sprawl to Governed Delivery: The Gateway's Role in Modernization](https://api7.ai/learning-center/api-gateway-guide/api-gateway-modernization)[84. API Monetization at the Gateway: Plans, Metering, Entitlements, and Billing Boundaries](https://api7.ai/learning-center/api-gateway-guide/api-monetization-gateway)[85. Safe AI-Assisted API Gateway Optimization: Recommendations, Guardrails, and Approval](https://api7.ai/learning-center/api-gateway-guide/ai-assisted-api-gateway-optimization)[86. API Gateways for Low-Code and No-Code Integration: Governance and Safety](https://api7.ai/learning-center/api-gateway-guide/api-gateways-low-code-no-code-integration)[87. API Gateway and CIAM Integration: Token Validation, Consent, and Identity Context](https://api7.ai/learning-center/api-gateway-guide/api-gateway-ciam-integration)[88. Elastic API Gateway Scaling: Signals, Capacity, and Safe Scale-In](https://api7.ai/learning-center/api-gateway-guide/elastic-api-gateway-scaling)[89. Multi-Tenant SaaS API Gateways: Isolation, Quotas, and Tenant-Aware Policy](https://api7.ai/learning-center/api-gateway-guide/multi-tenant-saas-api-gateway-policy)[90. API Gateway DevSecOps: Policy as Code, Testing, and Runtime Feedback](https://api7.ai/learning-center/api-gateway-guide/api-gateway-devsecops) 10 Platform Engineering and Planning [View this topic · 10](https://api7.ai/learning-center/api-gateway-guide?topic=platform-governance)[91. API Discovery and Documentation at the Gateway: Inventory, Ownership, and Drift](https://api7.ai/learning-center/api-gateway-guide/api-discovery-documentation-gateway)[92. WebAssembly Plugins for API Gateways: Portability, Isolation, and APISIX Boundaries](https://api7.ai/learning-center/api-gateway-guide/api-gateway-webassembly-plugins)[93. Monitoring API Gateways with Prometheus and Grafana: Metrics, Dashboards, and Alerts](https://api7.ai/learning-center/api-gateway-guide/monitor-api-gateways-prometheus-grafana)[94. API Gateway Reliability Engineering: SLOs, Failure Isolation, and Incident Response](https://api7.ai/learning-center/api-gateway-guide/api-gateway-reliability-engineering)[95. API Gateways for Edge AI Inference: Routing, Constraints, and Observability](https://api7.ai/learning-center/api-gateway-guide/api-gateways-edge-ai-inference)[96. Reducing Cloud Cost with API Gateway Controls: Measurement Before Optimization](https://api7.ai/learning-center/api-gateway-guide/reducing-cloud-cost-api-gateway-controls)[97. Improving API Developer Experience with Gateway Standards and Self-Service](https://api7.ai/learning-center/api-gateway-guide/improving-api-developer-experience-gateway-self-service)[98. API Gateway Change Management: Compatibility, Progressive Delivery, and Rollback](https://api7.ai/learning-center/api-gateway-guide/api-gateway-change-management-rollback)[99. Operating Serverless APIs: Cold Starts, Idempotency, and Asynchronous Handoffs](https://api7.ai/learning-center/api-gateway-guide/operating-serverless-apis-gateway)[100. Planning an API Gateway Roadmap for the Next Five Years](https://api7.ai/learning-center/api-gateway-guide/planning-api-gateway-roadmap-next-five-years) [API Gateway Guide](https://api7.ai/learning-center/api-gateway-guide)[Gateway Performance](https://api7.ai/learning-center/api-gateway-guide?topic=performance) On this page On this page - [Key Takeaways](#key-takeaways) - [Build a TLS Cost Model](#build-a-tls-cost-model) - [Measure New, Reused, and Resumed Paths](#measure-new-reused-and-resumed-paths) - [Inspect one connection with curl](#inspect-one-connection-with-curl) - [Inspect the negotiated session](#inspect-the-negotiated-session) - [Benchmark connection behavior explicitly](#benchmark-connection-behavior-explicitly) - [Optimization 1: Reuse Connections](#optimization-1-reuse-connections) - [Optimization 2: Prefer Current Protocols Without Weakening Policy](#optimization-2-prefer-current-protocols-without-weakening-policy) - [Optimization 3: Verify Session Resumption Across the Fleet](#optimization-3-verify-session-resumption-across-the-fleet) - [Treat 0-RTT as a separate security decision](#treat-0-rtt-as-a-separate-security-decision) - [Optimization 4: Keep Certificate Delivery Efficient](#optimization-4-keep-certificate-delivery-efficient) - [Configure an APISIX SSL Resource](#configure-an-apisix-ssl-resource) - [Optimize the Upstream TLS Leg Too](#optimize-the-upstream-tls-leg-too) - [Separate CPU Saturation from Network Latency](#separate-cpu-saturation-from-network-latency) - [Roll Out with Guardrails](#roll-out-with-guardrails) - [TLS Performance Checklist](#tls-performance-checklist) - [Summary](#summary) - [FAQ](#faq) - [Is TLS 1.3 always faster than TLS 1.2?](#is-tls-13-always-faster-than-tls-12) - [Should an API gateway enable TLS 1.3 0-RTT for better performance?](#should-an-api-gateway-enable-tls-13-0-rtt-for-better-performance) - [Does terminating TLS at the gateway remove all TLS cost?](#does-terminating-tls-at-the-gateway-remove-all-tls-cost) - [Next Steps](#next-steps) Article 50 # API Gateway TLS Performance: Handshakes, Session Reuse, and Measurement API7.ai September 8, 2026 The highest-value API gateway TLS optimization is usually to avoid unnecessary handshakes: keep client-to-gateway and gateway-to-upstream connections reusable, enable and verify session resumption where appropriate, and terminate TLS in a topology that does not repeatedly cross long network paths. Measure new and reused connections separately before tuning cryptography. Security constraints come first. Keep supported protocol versions, certificate validation, and key protection at the required level; optimize within that boundary instead of weakening it for a benchmark. ## Key Takeaways - Separate connection establishment from steady-state request processing in every measurement. - Reusing one authenticated connection usually saves more work than micro-tuning individual cipher operations. - TLS 1.3 reduces handshake round trips compared with TLS 1.2 in common full-handshake cases, but network path and connection behavior still dominate many workloads. - Session resumption must be tested across the real gateway fleet, including rotation and failover. - TLS 1.3 0-RTT data has replay risk; do not enable it casually for state-changing APIs. - Optimize both TLS legs when the gateway also uses HTTPS or mTLS to reach upstreams. ## Build a TLS Cost Model An HTTPS request through a gateway can contain two independent secure connections: ``` flowchart LR C[Client] <-->|TLS connection A| G[API Gateway] G <-->|TLS connection B| U[Upstream API] ``` Each new connection may require TCP establishment, a TLS handshake, certificate-chain transmission and validation, key agreement, and symmetric-key setup. DNS, routing, proxies, and packet loss can add time around those steps. Once a session is established, application records use much cheaper symmetric cryptography, but payload size and CPU still matter. Ask four questions before changing configuration: 1. What proportion of requests use a new client connection? 2. Can the gateway reuse its upstream connections? 3. How much of latency is network round-trip time versus gateway CPU? 4. Are session resumptions actually succeeding across instances and deploys? If nearly every request creates two new secure connections, cipher-level tuning is unlikely to fix the architectural waste. ## Measure New, Reused, and Resumed Paths Use a staging endpoint with the same certificate chain, gateway topology, protocol negotiation, and upstream TLS behavior as production. Test at realistic network distances; localhost hides handshake round trips. ### Inspect one connection with curl `curl` exposes useful timing fields: ``` curl --silent --output /dev/null \ --write-out 'connect=%{time_connect} tls=%{time_appconnect} start=%{time_starttransfer} total=%{time_total}\n' \ https://api.example.com/health ``` `time_appconnect` is elapsed time from start until the SSL/SSH handshake completes. Compare it with `time_connect`, time to first byte, and total time. One request is a diagnostic sample, not a performance result. ### Inspect the negotiated session ``` openssl s_client \ -connect api.example.com:443 \ -servername api.example.com \ -tls1_3 \n-----END CERTIFICATE-----", "key": "-----BEGIN PRIVATE KEY-----\n\n-----END PRIVATE KEY-----", "snis": ["api.example.com"], "ssl_protocols": ["TLSv1.2", "TLSv1.3"] } ``` Apply the file through the Admin API in a controlled environment: ``` curl "http://127.0.0.1:9180/apisix/admin/ssls/api-example" \ -X PUT \ -H "X-API-KEY: ${admin_key}" \ --data-binary @ssl.json ``` This resource selects protocols; it is not a complete performance configuration. Connection pooling, worker sizing, listener settings, session behavior, and any load balancer in front depend on the deployment. Confirm them against the APISIX and infrastructure versions you run. ## Optimize the Upstream TLS Leg Too When APISIX proxies to HTTPS, client-side handshake measurements show only half the path. A gateway that reuses downstream connections but creates a fresh upstream TLS connection for each request can still spend significant CPU and latency. Measure: - upstream connection creation and reuse; - upstream TLS handshake latency and failures; - upstream certificate verification and SNI correctness; - keep-alive pool hit rate and idle eviction; - mTLS certificate lookup and rotation behavior; - connection concentration on upstream nodes. Do not disable upstream certificate verification to improve latency. Fix trust-chain, naming, or connection-pool problems instead. If strict identity between gateway and service is required, [mutual TLS](https://apisix.apache.org/learning-center/what-is-mutual-tls/) adds client-certificate work and operational state that should be included in the benchmark. ## Separate CPU Saturation from Network Latency Handshake latency can rise because packets travel far or because gateway workers are CPU-saturated. The remedies differ. Network-dominated signals include stable gateway CPU, latency proportional to client distance, and improvement from fewer round trips or nearer termination. CPU-dominated signals include rising run queues, handshake throughput flattening, and latency increasing across all client regions as connection churn grows. Profile with production-like certificate algorithms, plugin chains, and traffic mixes. Avoid measuring TLS on an otherwise empty gateway and applying the result to one performing authentication, logging, compression, and transformations. Scale-out can help CPU capacity but can reduce resumption if new instances cannot use prior session state. Validate both effects together. ## Roll Out with Guardrails 1. Capture a baseline for new, reused, and resumed connections. 2. Change one layer at a time: client reuse, edge-to-gateway reuse, gateway-to-upstream reuse, protocol, or session configuration. 3. Compare latency percentiles, CPU per request, handshake rate, resumption success, connection errors, and certificate failures. 4. Canary across real client implementations and network paths. 5. Test rotation, instance replacement, and failover. 6. Keep a rollback path that does not restore deprecated protocols or unsafe verification settings. Watch error budgets as well as averages. A change that improves median handshake latency but causes a small group of important clients to fail is not a successful optimization. ## TLS Performance Checklist - Are new connections and persistent connections measured separately? - How many requests does each client and upstream connection carry? - Are TLS 1.2 and 1.3 choices compatible with policy and supported clients? - Is session resumption succeeding after load balancing, deploys, and rotation? - Is 0-RTT disabled or restricted to operations proven safe against replay? - Is the certificate chain complete and no larger than necessary? - Is upstream HTTPS or mTLS included in the cost model? - Are CPU, network distance, and application latency separated? - Have failover and certificate renewal been tested? ## Summary API gateway TLS performance is primarily a connection-lifecycle problem. Measure the full and steady-state paths, reuse connections on both sides of the gateway, validate TLS 1.3 and session resumption under the real fleet topology, and keep 0-RTT replay risk separate from ordinary resumption. APISIX can terminate modern TLS and manage certificates, but the best settings depend on client compatibility, topology, security policy, and observed connection behavior. ## FAQ ### Is TLS 1.3 always faster than TLS 1.2? It can reduce handshake round trips in common full-handshake cases, but the observed benefit depends on network distance, connection reuse, client support, resumption, and application latency. Measure the actual path. ### Should an API gateway enable TLS 1.3 0-RTT for better performance? Not by default. Early data has replay risk and requires an application-specific safety design. Ordinary connection reuse and session resumption usually provide safer first optimizations. ### Does terminating TLS at the gateway remove all TLS cost? No. The gateway still performs downstream TLS, and it may establish another TLS or mTLS connection to the upstream. Both legs belong in the capacity and latency model. ## Next Steps Baseline full, reused, and resumed connections, then verify the [APISIX SSL resource](https://apisix.apache.org/docs/apisix/admin-api/#ssl) fields supported by your release. For managed certificate and policy operations around Apache APISIX, explore [API7 Enterprise](https://api7.ai/enterprise). [Previous article**Asynchronous API Gateway Patterns: Queues, Callbacks, and Performance Boundaries**](https://api7.ai/learning-center/api-gateway-guide/asynchronous-api-gateway-patterns)[Next topic · Gateway Security**DDoS Defense at the API Gateway: Layered Controls and Failure Planning**](https://api7.ai/learning-center/api-gateway-guide/api-gateway-ddos-defense) On this page - [Key Takeaways](#key-takeaways) - [Build a TLS Cost Model](#build-a-tls-cost-model) - [Measure New, Reused, and Resumed Paths](#measure-new-reused-and-resumed-paths) - [Inspect one connection with curl](#inspect-one-connection-with-curl) - [Inspect the negotiated session](#inspect-the-negotiated-session) - [Benchmark connection behavior explicitly](#benchmark-connection-behavior-explicitly) - [Optimization 1: Reuse Connections](#optimization-1-reuse-connections) - [Optimization 2: Prefer Current Protocols Without Weakening Policy](#optimization-2-prefer-current-protocols-without-weakening-policy) - [Optimization 3: Verify Session Resumption Across the Fleet](#optimization-3-verify-session-resumption-across-the-fleet) - [Treat 0-RTT as a separate security decision](#treat-0-rtt-as-a-separate-security-decision) - [Optimization 4: Keep Certificate Delivery Efficient](#optimization-4-keep-certificate-delivery-efficient) - [Configure an APISIX SSL Resource](#configure-an-apisix-ssl-resource) - [Optimize the Upstream TLS Leg Too](#optimize-the-upstream-tls-leg-too) - [Separate CPU Saturation from Network Latency](#separate-cpu-saturation-from-network-latency) - [Roll Out with Guardrails](#roll-out-with-guardrails) - [TLS Performance Checklist](#tls-performance-checklist) - [Summary](#summary) - [FAQ](#faq) - [Is TLS 1.3 always faster than TLS 1.2?](#is-tls-13-always-faster-than-tls-12) - [Should an API gateway enable TLS 1.3 0-RTT for better performance?](#should-an-api-gateway-enable-tls-13-0-rtt-for-better-performance) - [Does terminating TLS at the gateway remove all TLS cost?](#does-terminating-tls-at-the-gateway-remove-all-tls-cost) - [Next Steps](#next-steps)