<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<div class="moz-cite-prefix">Это я уже опробовал. Также пробовал
сборку с патчем от Cloudflare (динамический размер записей TLS) с
дефолтными настройками:<br>
</div>
<div class="moz-cite-prefix"><br>
</div>
<div class="moz-cite-prefix">ssl_dyn_rec_enable on;<br>
ssl_dyn_rec_size_lo 1369;<br>
ssl_dyn_rec_size_hi 4229;<br>
ssl_dyn_rec_threshold 20;<br>
ssl_dyn_rec_timeout 10;<br>
</div>
<div class="moz-cite-prefix"><br>
</div>
<div class="moz-cite-prefix">получил даже небольшую регрессию)<br>
</div>
<div class="moz-cite-prefix"><br>
</div>
<div class="moz-cite-prefix">08.04.2021 18:18, Константин Ткаченко
пишет:<br>
</div>
<blockquote type="cite"
cite="mid:2E41271E-0C42-4B8F-957D-C8FAF6928A3D@mellodesign.ru">
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<br class="">
<div><br class="">
<blockquote type="cite" class="">
<div class="">8 апр. 2021 г., в 15:04, Илья Шипицин <<a
href="mailto:chipitsine@gmail.com" class=""
moz-do-not-send="true">chipitsine@gmail.com</a>>
написал(а):</div>
<br class="Apple-interchange-newline">
<div class="">
<div dir="auto" class="">Действительно. Я проглядел</div>
<br class="">
<div class="gmail_quote">
<div dir="ltr" class="gmail_attr">On Thu, Apr 8, 2021,
2:32 PM <a href="mailto:raven_kg@megaline.kg" class=""
moz-do-not-send="true">raven_kg@megaline.kg</a> <<a
href="mailto:raven_kg@megaline.kg" class=""
moz-do-not-send="true">raven_kg@megaline.kg</a>>
wrote:<br class="">
</div>
<blockquote class="gmail_quote" style="margin:0 0 0
.8ex;border-left:1px #ccc solid;padding-left:1ex">
<div class="">
<div class="">Включен)<br class="">
</div>
<div class="">> ssl_stapling on; <br class="">
</div>
<div class=""><br class="">
</div>
<div class=""><br class="">
</div>
<div class="">08.04.2021 17:29, Илья Шипицин пишет:<br
class="">
</div>
<blockquote type="cite" class="">
<div dir="auto" class="">Попробуйте stapling
включить</div>
<br class="">
<div class="gmail_quote">
<div dir="ltr" class="gmail_attr">On Thu, Apr 8,
2021, 2:28 PM <a
href="mailto:raven_kg@megaline.kg"
target="_blank" rel="noreferrer" class=""
moz-do-not-send="true">raven_kg@megaline.kg</a>
<<a href="mailto:raven_kg@megaline.kg"
target="_blank" rel="noreferrer" class=""
moz-do-not-send="true">raven_kg@megaline.kg</a>>
wrote:<br class="">
</div>
<blockquote class="gmail_quote" style="margin:0 0
0 .8ex;border-left:1px #ccc
solid;padding-left:1ex">
<div class="">
<p class="">Доброго дня!</p>
<p class="">nginx 1.18.0, собран с OpenSSL
1.1.1c FIPS. <br class="">
</p>
<p class="">Замечено, что по https отдача
первого байта происходит на 200мс дольше. <br
class="">
</p>
<p class=""><br class="">
</p>
<p class=""># curl -s -o /dev/null -w
"Connect: %{time_connect} TTFB:
%{time_starttransfer} Total time:
%{time_total} \n"
https://<domain>/robots.txt<br
class="">
Connect: 0,101801 TTFB: 0,424129 Total time:
0,424269 <br class="">
# curl -s -o /dev/null -w "Connect:
%{time_connect} TTFB: %{time_starttransfer}
Total time: %{time_total} \n"
http://<domain>/robots.txt<br class="">
Connect: 0,099435 TTFB: 0,196609 Total time:
0,196732 <br class="">
</p>
<p class=""><br class="">
</p>
<p class="">Для меня не новость, что SSL
требует время для шифрования, но не
слишком-ли много? Ниже выдержки из конфига
со всем, что касается SSL:<br class="">
</p>
<p class=""><br class="">
</p>
<blockquote class="">
<p class="">ssl_protocols TLSv1
TLSv1.1 TLSv1.2 TLSv1.3;<br class="">
<br class="">
ssl_ciphers
ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA256:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA;<br
class="">
<br class="">
ssl_prefer_server_ciphers off;<br class="">
ssl_session_cache
shared:SSLCache:16m;<br class="">
ssl_session_timeout 10m;<br class="">
ssl_session_tickets off;<br class="">
ssl_dhparam
/etc/nginx/ssl/dh1024.pem;<br class="">
ssl_ecdh_curve secp384r1;<br
class="">
ssl_buffer_size 16k;</p>
<p class="">server {</p>
<p class="">listen :80 fastopen=256;</p>
<p class="">listen :443 fastopen=256 ssl;
#http2<br class="">
</p>
<p class="">ssl_certificate_key
/etc/nginx/ssl/<domain>.key;<br
class="">
ssl_certificate
/etc/nginx/ssl/<domain>.pem;<br
class="">
ssl_stapling on;<br class="">
ssl_stapling_verify on;<br class="">
ssl_trusted_certificate
/etc/nginx/ssl/<domain>.pem;</p>
<p class="">...<br class="">
</p>
<p class="">}<br class="">
</p>
</blockquote>
<p class=""><br class="">
</p>
</div>
_______________________________________________<br
class="">
nginx-ru mailing list<br class="">
<a href="mailto:nginx-ru@nginx.org"
rel="noreferrer noreferrer" target="_blank"
class="" moz-do-not-send="true">nginx-ru@nginx.org</a><br
class="">
<a
href="http://mailman.nginx.org/mailman/listinfo/nginx-ru"
rel="noreferrer noreferrer noreferrer"
target="_blank" class=""
moz-do-not-send="true">http://mailman.nginx.org/mailman/listinfo/nginx-ru</a></blockquote>
</div>
<br class="">
<fieldset class=""></fieldset>
<pre class="">_______________________________________________
nginx-ru mailing list
<a href="mailto:nginx-ru@nginx.org" target="_blank" rel="noreferrer" class="" moz-do-not-send="true">nginx-ru@nginx.org</a>
<a href="http://mailman.nginx.org/mailman/listinfo/nginx-ru" target="_blank" rel="noreferrer" class="" moz-do-not-send="true">http://mailman.nginx.org/mailman/listinfo/nginx-ru</a></pre>
</blockquote>
<p class=""><br class="">
</p>
</div>
_______________________________________________<br
class="">
nginx-ru mailing list<br class="">
<a href="mailto:nginx-ru@nginx.org" target="_blank"
rel="noreferrer" class="" moz-do-not-send="true">nginx-ru@nginx.org</a><br
class="">
<a
href="http://mailman.nginx.org/mailman/listinfo/nginx-ru"
rel="noreferrer noreferrer" target="_blank" class=""
moz-do-not-send="true">http://mailman.nginx.org/mailman/listinfo/nginx-ru</a></blockquote>
</div>
_______________________________________________<br class="">
nginx-ru mailing list<br class="">
<a href="mailto:nginx-ru@nginx.org" class=""
moz-do-not-send="true">nginx-ru@nginx.org</a><br class="">
<a class="moz-txt-link-freetext" href="http://mailman.nginx.org/mailman/listinfo/nginx-ru">http://mailman.nginx.org/mailman/listinfo/nginx-ru</a></div>
</blockquote>
</div>
<br class="">
<div class="">Можно уменьшить ssl_buffer_size до 4k; </div>
<div class="">Об этом в доках тоже есть</div>
<div class=""><a
href="https://nginx.org/ru/docs/http/ngx_http_ssl_module.html#ssl_buffer_size"
class="" moz-do-not-send="true">https://nginx.org/ru/docs/http/ngx_http_ssl_module.html#ssl_buffer_size</a></div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<pre class="moz-quote-pre" wrap="">_______________________________________________
nginx-ru mailing list
<a class="moz-txt-link-abbreviated" href="mailto:nginx-ru@nginx.org">nginx-ru@nginx.org</a>
<a class="moz-txt-link-freetext" href="http://mailman.nginx.org/mailman/listinfo/nginx-ru">http://mailman.nginx.org/mailman/listinfo/nginx-ru</a></pre>
</blockquote>
<p><br>
</p>
</body>
</html>