TLS is the protocol of choice for securing today's e-commerce and online transactions, but adding TLS to a web server imposes a significant overhead relative to an insecure web server on the same platform. We perform a comprehensive study of the performance costs of TLS. Our methodology is to profile TLS web servers with trace-driven workloads, replace individual components inside TLS with no-ops and measure the observed increase in server throughput. We estimate the relative costs of each TLS processing stage, identifying the areas for which future optimizations would be worthwhile. Our results show that while the RSA operations represent the largest performance cost in TLS web servers, they do not solely account for TLS overhead. RSA accelerators are effective for e-commerce site workloads since they experience low TLS session reuse. Accelerators appear to be less effective for sites at which all requests are handled by a TLS server, because they have a higher session reuse rate. In this case investing in a faster CPU might provide a greater boost in performance. Our experiments show that having a second CPU is at least as useful as an RSA accelerator. As CPUs become more powerful, the relative cost of the cryptographic components of TLS is decreasing; faster CPUs will eventually bridge the performance gap between TLS-secured and insecure web servers. Our results suggest that long-term research efforts should consequently focus on designing more efficient web servers.