Why HTTPS for Everything?

Re:Why HTTPS for Everything? by umanwizard on Monday January 02, 2017 @01:23PM (#13303138)

I worked for junglee.com (a relatively unknown site owned by Amazon that used very little CPU) and extra latency on HTTPS was a massive, serious issue.

What flaw in our software or serious configuration mistake do you think we had?

[ Parent | on HN ]

Re:Why HTTPS for Everything? by hannob on Monday January 02, 2017 @02:17PM (#13303590)

Based on the current configuration: No OCSP stapling and no elliptic curve key exchange.

Also your setup suffers from TLS version intolerance, which by itself isn't a performance issue, but it is a hint that you're using a badly written TLS stack.

https://www.ssllabs.com/ssltest/analyze.html?d=junglee.com&s...

[ Parent | on HN ]

Re:Why HTTPS for Everything? by umanwizard on Monday January 02, 2017 @02:50PM (#13303842)

And how much do those increase first byte latency? (which is the real problem)

[ Parent | on HN ]

Re:Why HTTPS for Everything? by konklone on Monday January 02, 2017 @03:01PM (#13303944)

Tough to say without knowing more about the stack. But in terms of first byte latency, some things you can look at:

* TLS False Start

* HTTP/2 + ALPN

* Optimizing TLS record size

Some 2013-era advice for nginx here: https://www.igvita.com/2013/12/16/optimizing-nginx-tls-time-...

And some other advice and links here: https://istlsfastyet.com/

[ Parent | on HN ]

Re:Why HTTPS for Everything? by hannob on Monday January 02, 2017 @03:09PM (#13304018)

Pretty much all of them matter for first byte latency. OCSP & the key exchange both happen before any data can be exchanged.

[ Parent | on HN ]