4

I have an OpenSSL setup on my Linux PC using Apache2.

NO, I haven't enabled DNS resolving. I have the certificate on the machine, LOCALLY.

Still, Chrome devtools tell me that Initial Connection took 1.64 s. That's a lot of waiting for me when it comes to refreshing the page after a specific time has passed.

How to speed that up or is that the way it's supposed to be?

PS: I'm using StartCom's free ssl.

Improve this question
7
  • What is the time without SSL
    – SeanClt
    Apr 17, 2016 at 12:21
  • 2ms (I'm in the same network as the server).
    – ForceMagic
    Apr 17, 2016 at 12:23
  • This is not very exact for me. What I want is either a config option or a simple script in any language.
    – ForceMagic
    Apr 17, 2016 at 12:26
  • 1
    You question is generic it's not like you had a very detailed question
    – SeanClt
    Apr 17, 2016 at 12:28
  • I suspect issue is a certificate issue doesn't matter what you want
    – SeanClt
    Apr 17, 2016 at 12:28

2 Answers 2

Reset to default
5

There are several areas to improve SSL connection (and general SSL traffic latency). Some of these may impact security in some small or great way.

(These are for ssl.conf using Apache)

Disable the Domain lookup, and allow Non-SNI to reach primary domain

  • SSLStrictSNIVHostCheck off

Instead of named hosts, use IP address for the :443 VHOST entry

Cache SSL Sessions

  • SSLSessionCache shmcb:/run/httpd/sslcache(512000)
  • SSLSessionCacheTimeout 300

Allow for faster SSL Protocol order, general compatibility, medium security:

  • SSLProtocol all -SSLv3
  • SSLCipherSuite ALL:+HIGH:+TLSv1:!ADH:!EXP:!SSLv2:!MEDIUM:!LOW:!NULL:!aNULL
  • SSLHonorCipherOrder on

OCSP Stapling (speeds up SSL)

  • SSLUseStapling on
  • SSLStaplingResponderTimeout 5
  • SSLStaplingReturnResponderErrors off
  • SSLStaplingCache shmcb:/run/ocsp(128000)

HSTS (can do preload so http:// requests become https:// requests in the browser

  • Header always set Strict-Transport-Security "max-age=63072000; includeSubdomains; preload"

Submit for preload here: https://hstspreload.appspot.com/

Consider the following more advanced implementations:

  • HTTP/2 with HPACK
  • Brotli Compression

Other non-SSL issues that may help speed up connnection

Another directive for Apache in httpd.conf

  • HostnameLookups Off
Improve this answer
2
  • I agree with @ForceMagic below regarding Let's Encrypt as well, though I don't know if it is better than StartCom SSL, I do know it is free and also is not too difficult to implement and manage.
    – jeffmcneill
    Dec 1, 2016 at 4:59
  • Nice explanation, well-written and (kind of) easy to understand. Thanks! +1
    – ForceMagic
    Dec 1, 2016 at 21:53
1

Don't use StartCom.

Instead, use Let's Encrypt, with the --apache autoconfig option.

It will ask you everything user-friendly and you can fully customize your Apache config after setting up the Let's Encrypt SSL.

So, the problem is solved by deleting the StartCom SSL and auto-configuring apache with Let's Encrypt.

I don't really know what's the initial problem here, but Let's Encrypt seems to be optimized better.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .