Impact of ssl on a web server
Many of us have web servers and application servers that use plain TCP.
Some of us have web servers and other servers that use a secure layer like SSL.
My understanding of SSL is that the handshake is very computationally intensive and encrypting the current connection is (relatively) cheap.
My guess for you to fix: average hosting (and information on what is average in cloud hosting would be cool too), you can easily expect it to be able to saturate its network connections with AES encrypted packets, but have a hard time making a thousand handshakes RSA per second. Client authentication with server certificates is significantly more expensive than anonymous clients.
What are the rules for the number of sessions per second for SSL?
a source to share
Why not just measure? This will give you real numbers on the exact software and hardware you are using. You will also be able to measure the impact of changes to the server infrastructure (by adding more boxes, SSL accelerators, settings that you have).
You are correct that it will be difficult for you to get a thousand SSL handshakes per second on a single box. In fact, I would say this is possibly impossible. Several tens per second, not a problem. A thousand, not without a lot of $$$.
It's also likely that you don't need 1000 handshakes per second. This is quite a lot and you will need quite a lot of traffic to do something like this: See: What do I need in SSL TPS performance?
Remember, you usually won't make new SSL connections all the time. Browsers do the handshake once and keep the connection open across multiple requests and / or pageviews, so your needs for handshakes per second may be much lower than you might think.
a source to share
As Ville said, there is no real way to try it in configuration. But do not underestimate symmetric data encryption after link establishment. It may be cheaper, but if you are going to download a lot of data over an encrypted channel it can cost a lot more than the initial negotiation.
So, to do this, you need to create a general scenario for using your site and then a stress test.
a source to share