<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<div class="moz-cite-prefix">Включен)<br>
</div>
<div class="moz-cite-prefix">> ssl_stapling on; <br>
</div>
<div class="moz-cite-prefix"><br>
</div>
<div class="moz-cite-prefix"><br>
</div>
<div class="moz-cite-prefix">08.04.2021 17:29, Илья Шипицин пишет:<br>
</div>
<blockquote type="cite"
cite="mid:CAFHpkQG_xzmYj7riHhXDjHUWcX9ciOWxcUxt_a6sqV_k9zO=+Q@mail.gmail.com">
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
<div dir="auto">Попробуйте stapling включить</div>
<br>
<div class="gmail_quote">
<div dir="ltr" class="gmail_attr">On Thu, Apr 8, 2021, 2:28 PM <a
href="mailto:raven_kg@megaline.kg" moz-do-not-send="true">raven_kg@megaline.kg</a>
<<a href="mailto:raven_kg@megaline.kg"
moz-do-not-send="true">raven_kg@megaline.kg</a>> wrote:<br>
</div>
<blockquote class="gmail_quote" style="margin:0 0 0
.8ex;border-left:1px #ccc solid;padding-left:1ex">
<div>
<p>Доброго дня!</p>
<p>nginx 1.18.0, собран с OpenSSL 1.1.1c FIPS. <br>
</p>
<p>Замечено, что по https отдача первого байта происходит на
200мс дольше. <br>
</p>
<p><br>
</p>
<p># curl -s -o /dev/null -w "Connect: %{time_connect} TTFB:
%{time_starttransfer} Total time: %{time_total} \n"
https://<domain>/robots.txt<br>
Connect: 0,101801 TTFB: 0,424129 Total time: 0,424269 <br>
# curl -s -o /dev/null -w "Connect: %{time_connect} TTFB:
%{time_starttransfer} Total time: %{time_total} \n"
http://<domain>/robots.txt<br>
Connect: 0,099435 TTFB: 0,196609 Total time: 0,196732 <br>
</p>
<p><br>
</p>
<p>Для меня не новость, что SSL требует время для
шифрования, но не слишком-ли много? Ниже выдержки из
конфига со всем, что касается SSL:<br>
</p>
<p><br>
</p>
<blockquote>
<p>ssl_protocols TLSv1 TLSv1.1 TLSv1.2
TLSv1.3;<br>
<br>
ssl_ciphers
ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA256:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA;<br>
<br>
ssl_prefer_server_ciphers off;<br>
ssl_session_cache shared:SSLCache:16m;<br>
ssl_session_timeout 10m;<br>
ssl_session_tickets off;<br>
ssl_dhparam /etc/nginx/ssl/dh1024.pem;<br>
ssl_ecdh_curve secp384r1;<br>
ssl_buffer_size 16k;</p>
<p>server {</p>
<p>listen :80 fastopen=256;</p>
<p>listen :443 fastopen=256 ssl; #http2<br>
</p>
<p>ssl_certificate_key /etc/nginx/ssl/<domain>.key;<br>
ssl_certificate /etc/nginx/ssl/<domain>.pem;<br>
ssl_stapling on;<br>
ssl_stapling_verify on;<br>
ssl_trusted_certificate
/etc/nginx/ssl/<domain>.pem;</p>
<p>...<br>
</p>
<p>}<br>
</p>
</blockquote>
<p><br>
</p>
</div>
_______________________________________________<br>
nginx-ru mailing list<br>
<a href="mailto:nginx-ru@nginx.org" target="_blank"
rel="noreferrer" moz-do-not-send="true">nginx-ru@nginx.org</a><br>
<a href="http://mailman.nginx.org/mailman/listinfo/nginx-ru"
rel="noreferrer noreferrer" target="_blank"
moz-do-not-send="true">http://mailman.nginx.org/mailman/listinfo/nginx-ru</a></blockquote>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<pre class="moz-quote-pre" wrap="">_______________________________________________
nginx-ru mailing list
<a class="moz-txt-link-abbreviated" href="mailto:nginx-ru@nginx.org">nginx-ru@nginx.org</a>
<a class="moz-txt-link-freetext" href="http://mailman.nginx.org/mailman/listinfo/nginx-ru">http://mailman.nginx.org/mailman/listinfo/nginx-ru</a></pre>
</blockquote>
<p><br>
</p>
</body>
</html>