ITADN

Slowish server TLS handshakes

#749Openmbacarella 创建于 2025-08-07
M
mbacarellacommented
Before doing tests ```shell % cat curl-format.txt time_namelookup: %{time_namelookup}\n time_connect: %{time_connect}\n time_appconnect: %{time_appconnect}\n time_pretransfer: %{time_pretransfer}\n time_starttransfer: %{time_starttransfer}\n total_time: %{time_total}\n ``` The actual tests ```shell % curl -w "@curl-format.txt" -o /dev/null -s https://themotte.org time_namelookup: 0.093601 time_connect: 0.176599 time_appconnect: 0.271073 time_pretransfer: 0.271139 time_starttransfer: 0.650494 total_time: 0.650541 % curl -w "@curl-format.txt" -o /dev/null -s https://themotte.org time_namelookup: 0.023318 time_connect: 0.105032 time_appconnect: 0.200242 time_pretransfer: 0.200307 time_starttransfer: 0.283126 total_time: 0.283172 % curl -w "@curl-format.txt" -o /dev/null -s https://themotte.org/ time_namelookup: 0.070026 time_connect: 0.152325 time_appconnect: 0.369741 time_pretransfer: 0.369810 time_starttransfer: 0.461242 total_time: 0.461285 % curl -w "@curl-format.txt" -o /dev/null -s https://themotte.org time_namelookup: 0.021810 time_connect: 0.104186 time_appconnect: 0.202215 time_pretransfer: 0.202294 time_starttransfer: 0.287721 total_time: 0.287756 ``` The `time_appconnect` line is latency introduced by TLS handshakes. I think 200-350ms+ is kind of a big hit to tack on to everything else and perhaps it can be reduced. For contrast hitting google.com is about 98ms. I don't think anything is misconfigured really, Qualys SSL Lab gives an A+ report. Not to be presumptuous about available server resources but maybe it's just a matter of selecting a faster CPU?
6 条评论