<html>
  <head>
    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
  </head>
  <body>
    <div class="moz-cite-prefix">Это я уже опробовал. Также пробовал
      сборку с патчем от Cloudflare (динамический размер записей TLS) с
      дефолтными настройками:<br>
    </div>
    <div class="moz-cite-prefix"><br>
    </div>
    <div class="moz-cite-prefix">ssl_dyn_rec_enable    on;<br>
      ssl_dyn_rec_size_lo   1369;<br>
      ssl_dyn_rec_size_hi   4229;<br>
      ssl_dyn_rec_threshold 20;<br>
      ssl_dyn_rec_timeout   10;<br>
    </div>
    <div class="moz-cite-prefix"><br>
    </div>
    <div class="moz-cite-prefix">получил даже небольшую регрессию)<br>
    </div>
    <div class="moz-cite-prefix"><br>
    </div>
    <div class="moz-cite-prefix">08.04.2021 18:18, Константин Ткаченко
      пишет:<br>
    </div>
    <blockquote type="cite"
      cite="mid:2E41271E-0C42-4B8F-957D-C8FAF6928A3D@mellodesign.ru">
      <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
      <br class="">
      <div><br class="">
        <blockquote type="cite" class="">
          <div class="">8 апр. 2021 г., в 15:04, Илья Шипицин <<a
              href="mailto:chipitsine@gmail.com" class=""
              moz-do-not-send="true">chipitsine@gmail.com</a>>
            написал(а):</div>
          <br class="Apple-interchange-newline">
          <div class="">
            <div dir="auto" class="">Действительно. Я проглядел</div>
            <br class="">
            <div class="gmail_quote">
              <div dir="ltr" class="gmail_attr">On Thu, Apr 8, 2021,
                2:32 PM <a href="mailto:raven_kg@megaline.kg" class=""
                  moz-do-not-send="true">raven_kg@megaline.kg</a> <<a
                  href="mailto:raven_kg@megaline.kg" class=""
                  moz-do-not-send="true">raven_kg@megaline.kg</a>>
                wrote:<br class="">
              </div>
              <blockquote class="gmail_quote" style="margin:0 0 0
                .8ex;border-left:1px #ccc solid;padding-left:1ex">
                <div class="">
                  <div class="">Включен)<br class="">
                  </div>
                  <div class="">> ssl_stapling on; <br class="">
                  </div>
                  <div class=""><br class="">
                  </div>
                  <div class=""><br class="">
                  </div>
                  <div class="">08.04.2021 17:29, Илья Шипицин пишет:<br
                      class="">
                  </div>
                  <blockquote type="cite" class="">
                    <div dir="auto" class="">Попробуйте stapling
                      включить</div>
                    <br class="">
                    <div class="gmail_quote">
                      <div dir="ltr" class="gmail_attr">On Thu, Apr 8,
                        2021, 2:28 PM <a
                          href="mailto:raven_kg@megaline.kg"
                          target="_blank" rel="noreferrer" class=""
                          moz-do-not-send="true">raven_kg@megaline.kg</a>
                        <<a href="mailto:raven_kg@megaline.kg"
                          target="_blank" rel="noreferrer" class=""
                          moz-do-not-send="true">raven_kg@megaline.kg</a>>
                        wrote:<br class="">
                      </div>
                      <blockquote class="gmail_quote" style="margin:0 0
                        0 .8ex;border-left:1px #ccc
                        solid;padding-left:1ex">
                        <div class="">
                          <p class="">Доброго дня!</p>
                          <p class="">nginx 1.18.0, собран с OpenSSL
                            1.1.1c FIPS. <br class="">
                          </p>
                          <p class="">Замечено, что по https отдача
                            первого байта происходит на 200мс дольше. <br
                              class="">
                          </p>
                          <p class=""><br class="">
                          </p>
                          <p class=""># curl -s -o /dev/null -w
                            "Connect: %{time_connect} TTFB:
                            %{time_starttransfer} Total time:
                            %{time_total} \n"
                            https://<domain>/robots.txt<br
                              class="">
                            Connect: 0,101801 TTFB: 0,424129 Total time:
                            0,424269 <br class="">
                            # curl -s -o /dev/null -w "Connect:
                            %{time_connect} TTFB: %{time_starttransfer}
                            Total time: %{time_total} \n"
                            http://<domain>/robots.txt<br class="">
                            Connect: 0,099435 TTFB: 0,196609 Total time:
                            0,196732 <br class="">
                          </p>
                          <p class=""><br class="">
                          </p>
                          <p class="">Для меня не новость, что SSL
                            требует время для шифрования, но не
                            слишком-ли много? Ниже выдержки из конфига
                            со всем, что касается SSL:<br class="">
                          </p>
                          <p class=""><br class="">
                          </p>
                          <blockquote class="">
                            <p class="">ssl_protocols             TLSv1
                              TLSv1.1 TLSv1.2 TLSv1.3;<br class="">
                              <br class="">
                              ssl_ciphers              
ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA256:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA;<br
                                class="">
                              <br class="">
                              ssl_prefer_server_ciphers off;<br class="">
                              ssl_session_cache        
                              shared:SSLCache:16m;<br class="">
                              ssl_session_timeout       10m;<br class="">
                              ssl_session_tickets       off;<br class="">
                              ssl_dhparam              
                              /etc/nginx/ssl/dh1024.pem;<br class="">
                              ssl_ecdh_curve            secp384r1;<br
                                class="">
                              ssl_buffer_size           16k;</p>
                            <p class="">server {</p>
                            <p class="">listen :80 fastopen=256;</p>
                            <p class="">listen :443 fastopen=256 ssl;
                              #http2<br class="">
                            </p>
                            <p class="">ssl_certificate_key
                              /etc/nginx/ssl/<domain>.key;<br
                                class="">
                              ssl_certificate
                              /etc/nginx/ssl/<domain>.pem;<br
                                class="">
                              ssl_stapling on;<br class="">
                              ssl_stapling_verify on;<br class="">
                              ssl_trusted_certificate
                              /etc/nginx/ssl/<domain>.pem;</p>
                            <p class="">...<br class="">
                            </p>
                            <p class="">}<br class="">
                            </p>
                          </blockquote>
                          <p class=""><br class="">
                          </p>
                        </div>
                        _______________________________________________<br
                          class="">
                        nginx-ru mailing list<br class="">
                        <a href="mailto:nginx-ru@nginx.org"
                          rel="noreferrer noreferrer" target="_blank"
                          class="" moz-do-not-send="true">nginx-ru@nginx.org</a><br
                          class="">
                        <a
                          href="http://mailman.nginx.org/mailman/listinfo/nginx-ru"
                          rel="noreferrer noreferrer noreferrer"
                          target="_blank" class=""
                          moz-do-not-send="true">http://mailman.nginx.org/mailman/listinfo/nginx-ru</a></blockquote>
                    </div>
                    <br class="">
                    <fieldset class=""></fieldset>
                    <pre class="">_______________________________________________
nginx-ru mailing list
<a href="mailto:nginx-ru@nginx.org" target="_blank" rel="noreferrer" class="" moz-do-not-send="true">nginx-ru@nginx.org</a>
<a href="http://mailman.nginx.org/mailman/listinfo/nginx-ru" target="_blank" rel="noreferrer" class="" moz-do-not-send="true">http://mailman.nginx.org/mailman/listinfo/nginx-ru</a></pre>
                  </blockquote>
                  <p class=""><br class="">
                  </p>
                </div>
                _______________________________________________<br
                  class="">
                nginx-ru mailing list<br class="">
                <a href="mailto:nginx-ru@nginx.org" target="_blank"
                  rel="noreferrer" class="" moz-do-not-send="true">nginx-ru@nginx.org</a><br
                  class="">
                <a
                  href="http://mailman.nginx.org/mailman/listinfo/nginx-ru"
                  rel="noreferrer noreferrer" target="_blank" class=""
                  moz-do-not-send="true">http://mailman.nginx.org/mailman/listinfo/nginx-ru</a></blockquote>
            </div>
            _______________________________________________<br class="">
            nginx-ru mailing list<br class="">
            <a href="mailto:nginx-ru@nginx.org" class=""
              moz-do-not-send="true">nginx-ru@nginx.org</a><br class="">
            <a class="moz-txt-link-freetext" href="http://mailman.nginx.org/mailman/listinfo/nginx-ru">http://mailman.nginx.org/mailman/listinfo/nginx-ru</a></div>
        </blockquote>
      </div>
      <br class="">
      <div class="">Можно уменьшить ssl_buffer_size до 4k; </div>
      <div class="">Об этом в доках тоже есть</div>
      <div class=""><a
href="https://nginx.org/ru/docs/http/ngx_http_ssl_module.html#ssl_buffer_size"
          class="" moz-do-not-send="true">https://nginx.org/ru/docs/http/ngx_http_ssl_module.html#ssl_buffer_size</a></div>
      <br>
      <fieldset class="mimeAttachmentHeader"></fieldset>
      <pre class="moz-quote-pre" wrap="">_______________________________________________
nginx-ru mailing list
<a class="moz-txt-link-abbreviated" href="mailto:nginx-ru@nginx.org">nginx-ru@nginx.org</a>
<a class="moz-txt-link-freetext" href="http://mailman.nginx.org/mailman/listinfo/nginx-ru">http://mailman.nginx.org/mailman/listinfo/nginx-ru</a></pre>
    </blockquote>
    <p><br>
    </p>
  </body>
</html>