First of all, choosing the right encryption algorithm defines the security level of your VDI gateway. Indeed, many administrators still rely on RSA because it offers universal compatibility. However, the rise of modern threats requires a more efficient approach to SSL/TLS certificates. Furthermore, understanding the difference between RSA vs ECDSA helps you optimize both security and performance. Consequently, we decided to compare these two standards specifically for Parallels RAS environments. Finally, this guide will help you select the best option for your specific infrastructure.
This benchmark compares the three realistic options in 2026: RSA 4096, ECDSA P-256, and ECDSA P-384. Tests were conducted on a Parallels RAS 21 environment using a Microsoft ADCS PKI, from a Linux client over LAN.
Why TLS Certificates Impact Performance
When a user starts a Parallels RAS session, the first step is a TLS handshake between the client and the Secure Gateway. This is where the certificate is used: it authenticates the server and establishes the encrypted channel. Once the session is established, all RAS traffic uses symmetric AES-256-GCM encryption — at that point, the certificate type no longer has any impact.
With a few dozen users, the difference is negligible. But in deployments with 3,500 to 6,000 users logging in between 8 AM and 9 AM, multiplying the handshake cost by the number of simultaneous connections results in a very real CPU load on your Secure Gateways.
TLS Certificate Families in 2026
RSA — The legacy standard. Large keys (2048, 4096 bits), computationally expensive asymmetric operations on the server side. Maximum compatibility with all clients, including legacy systems. Considered a legacy choice in 2026.
ECDSA (NIST curves) — Based on elliptic curve cryptography. P-256 provides 128-bit equivalent security — effectively unbreakable with current capabilities. This is the recommended choice for Parallels RAS.
EdDSA / Ed25519 — Based on Bernstein curves, more modern than ECDSA and very fast. However, client compatibility (especially Windows) must be validated depending on your RAS version.
Post-quantum (ML-KEM, ML-DSA) — Standardized by NIST in 2024. Not yet usable in production for RAS. Realistic horizon: 2027–2028.
Benchmark Setup
Three dedicated Parallels RAS listeners on three distinct FQDNs pointing to the same IP. Certificates issued by a Microsoft ADCS PKI (Windows Server 2025). Measurements performed from a Kali Linux client over LAN using curl (5 runs), Apache Benchmark (100 requests, 20 concurrent connections), and Wireshark/tshark.
Results — TLS Handshake Time (curl)
Average over 5 runs from a Linux client on LAN:
| Certificate | Run 1 | Run 2 | Run 3 | Run 4 | Run 5 | Average | Gain |
|---|---|---|---|---|---|---|---|
| RSA 4096 | 19.9 ms | 18.6 ms | 16.2 ms | 16.2 ms | 16.5 ms | 17.5 ms | — |
| ECDSA P-256 | 9.9 ms | 8.4 ms | 9.8 ms | 8.4 ms | 8.5 ms | 9.0 ms | −49% |
| ECDSA P-384 | 11.2 ms | 13.1 ms | 13.8 ms | 12.2 ms | 11.4 ms | 12.3 ms | −30% |
ECDSA P-256 delivers nearly 2x faster handshakes compared to RSA 4096.
Results — Load Under 20 Concurrent Connections (ab)
| Certificate | Req/sec | Median Connect | Median Total | Max (p100) |
|---|---|---|---|---|
| RSA 4096 | 96.7 | 84 ms | 118 ms | 604 ms |
| ECDSA P-256 | 199.5 | 47 ms | 72 ms | 165 ms |
| ECDSA P-384 | 165.5 | 57 ms | 95 ms | 200 ms |
P-256 handles twice as many connections per second as RSA 4096 (199 vs 97 req/s). The maximum latency spike reaches 604 ms with RSA, compared to 165 ms with P-256 — exactly what translates into visible slowdowns during morning login peaks.
Results — Handshake Size (Wireshark)
| Certificate | Client Hello | Server Hello + Cert | Total | Savings vs RSA |
|---|---|---|---|---|
| RSA 4096 | 1 779 bytes | 3 505 bytes | 5 284 bytes | — |
| ECDSA P-256 | 1 781 bytes | 2 571 bytes | 4 352 bytes | −18% |
| ECDSA P-384 | 1 781 bytes | 2 633 bytes | 4 414 bytes | −16% |
The entire difference comes from the Server Hello: an RSA 4096 public key weighs ~512 bytes versus ~65 bytes for P-256, significantly increasing the server response size.
Why Not Use P-384 by Default?
P-256 provides 128-bit equivalent security — already considered secure beyond 2030. P-384 increases this to 192 bits, which is overkill for most RAS deployments. Use it only if required by strict regulatory standards.
P-384 is like installing a high-security reinforced door on a bunker that already has one — while the walls are still made of concrete blocks. Real security gains come from MFA, network segmentation, and RDSH hardening.
Recommendation
ECDSA P-256 is the production choice for Parallels RAS in 2026. Faster handshakes, lower CPU usage, higher throughput, and reduced bandwidth consumption.
- P-384 only if explicitly required by policy
- RSA 4096 only for legacy compatibility scenarios
Post-Quantum Outlook
NIST standardized ML-KEM and ML-DSA in 2024. Realistic adoption in Parallels RAS environments is expected around 2027–2028. Until then, P-256 remains the optimal choice.
