<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><br class=""><div><br class=""><blockquote type="cite" class=""><div class="">8 апр. 2021 г., в 15:04, Илья Шипицин <<a href="mailto:chipitsine@gmail.com" class="">chipitsine@gmail.com</a>> написал(а):</div><br class="Apple-interchange-newline"><div class=""><div dir="auto" class="">Действительно. Я проглядел</div><br class=""><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Thu, Apr 8, 2021, 2:32 PM <a href="mailto:raven_kg@megaline.kg" class="">raven_kg@megaline.kg</a> <<a href="mailto:raven_kg@megaline.kg" class="">raven_kg@megaline.kg</a>> wrote:<br class=""></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div class="">
<div class="">Включен)<br class="">
</div>
<div class="">> ssl_stapling on; <br class="">
</div>
<div class=""><br class="">
</div>
<div class=""><br class="">
</div>
<div class="">08.04.2021 17:29, Илья Шипицин пишет:<br class="">
</div>
<blockquote type="cite" class="">
<div dir="auto" class="">Попробуйте stapling включить</div>
<br class="">
<div class="gmail_quote">
<div dir="ltr" class="gmail_attr">On Thu, Apr 8, 2021, 2:28 PM <a href="mailto:raven_kg@megaline.kg" target="_blank" rel="noreferrer" class="">raven_kg@megaline.kg</a>
<<a href="mailto:raven_kg@megaline.kg" target="_blank" rel="noreferrer" class="">raven_kg@megaline.kg</a>> wrote:<br class="">
</div>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div class=""><p class="">Доброго дня!</p><p class="">nginx 1.18.0, собран с OpenSSL 1.1.1c FIPS. <br class="">
</p><p class="">Замечено, что по https отдача первого байта происходит на
200мс дольше. <br class="">
</p><p class=""><br class="">
</p><p class=""># curl -s -o /dev/null -w "Connect: %{time_connect} TTFB:
%{time_starttransfer} Total time: %{time_total} \n"
https://<domain>/robots.txt<br class="">
Connect: 0,101801 TTFB: 0,424129 Total time: 0,424269 <br class="">
# curl -s -o /dev/null -w "Connect: %{time_connect} TTFB:
%{time_starttransfer} Total time: %{time_total} \n"
http://<domain>/robots.txt<br class="">
Connect: 0,099435 TTFB: 0,196609 Total time: 0,196732 <br class="">
</p><p class=""><br class="">
</p><p class="">Для меня не новость, что SSL требует время для
шифрования, но не слишком-ли много? Ниже выдержки из
конфига со всем, что касается SSL:<br class="">
</p><p class=""><br class="">
</p>
<blockquote class=""><p class="">ssl_protocols TLSv1 TLSv1.1 TLSv1.2
TLSv1.3;<br class="">
<br class="">
ssl_ciphers
ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA256:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA;<br class="">
<br class="">
ssl_prefer_server_ciphers off;<br class="">
ssl_session_cache shared:SSLCache:16m;<br class="">
ssl_session_timeout 10m;<br class="">
ssl_session_tickets off;<br class="">
ssl_dhparam /etc/nginx/ssl/dh1024.pem;<br class="">
ssl_ecdh_curve secp384r1;<br class="">
ssl_buffer_size 16k;</p><p class="">server {</p><p class="">listen :80 fastopen=256;</p><p class="">listen :443 fastopen=256 ssl; #http2<br class="">
</p><p class="">ssl_certificate_key /etc/nginx/ssl/<domain>.key;<br class="">
ssl_certificate /etc/nginx/ssl/<domain>.pem;<br class="">
ssl_stapling on;<br class="">
ssl_stapling_verify on;<br class="">
ssl_trusted_certificate
/etc/nginx/ssl/<domain>.pem;</p><p class="">...<br class="">
</p><p class="">}<br class="">
</p>
</blockquote><p class=""><br class="">
</p>
</div>
_______________________________________________<br class="">
nginx-ru mailing list<br class="">
<a href="mailto:nginx-ru@nginx.org" rel="noreferrer noreferrer" target="_blank" class="">nginx-ru@nginx.org</a><br class="">
<a href="http://mailman.nginx.org/mailman/listinfo/nginx-ru" rel="noreferrer noreferrer noreferrer" target="_blank" class="">http://mailman.nginx.org/mailman/listinfo/nginx-ru</a></blockquote>
</div>
<br class="">
<fieldset class=""></fieldset>
<pre class="">_______________________________________________
nginx-ru mailing list
<a href="mailto:nginx-ru@nginx.org" target="_blank" rel="noreferrer" class="">nginx-ru@nginx.org</a>
<a href="http://mailman.nginx.org/mailman/listinfo/nginx-ru" target="_blank" rel="noreferrer" class="">http://mailman.nginx.org/mailman/listinfo/nginx-ru</a></pre>
</blockquote><p class=""><br class="">
</p>
</div>
_______________________________________________<br class="">
nginx-ru mailing list<br class="">
<a href="mailto:nginx-ru@nginx.org" target="_blank" rel="noreferrer" class="">nginx-ru@nginx.org</a><br class="">
<a href="http://mailman.nginx.org/mailman/listinfo/nginx-ru" rel="noreferrer noreferrer" target="_blank" class="">http://mailman.nginx.org/mailman/listinfo/nginx-ru</a></blockquote></div>
_______________________________________________<br class="">nginx-ru mailing list<br class=""><a href="mailto:nginx-ru@nginx.org" class="">nginx-ru@nginx.org</a><br class="">http://mailman.nginx.org/mailman/listinfo/nginx-ru</div></blockquote></div><br class=""><div class="">Можно уменьшить ssl_buffer_size до 4k; </div><div class="">Об этом в доках тоже есть</div><div class=""><a href="https://nginx.org/ru/docs/http/ngx_http_ssl_module.html#ssl_buffer_size" class="">https://nginx.org/ru/docs/http/ngx_http_ssl_module.html#ssl_buffer_size</a></div></body></html>