3 ms·

EDIT: You mentioned 300ms extra. Ideally, SSL should only require 2 extra RTT on first connection, so in theory you should only see 300ms extra latency if: a)

• jrochkind1 14y ago
  thank you, useful link! something may very well be wrong, and it may be outside of my abilities or time to figure out what. :) I am looking into increasing the SSL Session keeping length on my apache, have any opinion about that? It does seem to eliminate the extra 'tax' for SSL in my from-slow-network experiments, for the duration of the session eliminating re-negotiation.
  • xyzzy123 14y ago
    Cool :) As ballpark figures for SSL session cache timeouts, Apache defaults to 5 minutes, F5 load balancers default to 1 hour and JBoss is 1 day. So it really seems like a wide range of values get used out in the world. Upping to an hour should cause no problems. With SHM cache that will use a bit more memory, should make no practical difference for DBM. The other thing to watch out for (mentioned at link) is that lots of cheap SSL certs have a cert chain like 4 or 5 items long, bloating startup. See, e.g: https://www.ssllabs.com/ssltest/analyze.html?d=zxc.mx&hideResults=on https://www.ssllabs.com/ssltest/analyze.html?d=zxc.mx&hi... That shows that 5983 bytes of intermediate certs are being sent over and above the actual server cert. That's going to eat a bunch of RTTs during SSL setup.