Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've set up ssl_certificate and ssl_certificate_key directives at the http level of my nginx configuration. The problem I'm facing is that starting/reloading nginx is getting slower and slower as more hosts (server directives) are added. The server has roughly 1000 SSL-enabled hosts that inherits the ssl certificate directives.

I know nginx verifies/checks the certificate when loading it, so I'm wondering if nginx checks the certificate each time an SSL enabled host inherits the shared certificate? If so, shouldn't it only check the certificate once? According to http://nginx.org/en/docs/http/configuring_https_servers.html it should cause all hosts to inherit a single memory footprint, but this doesn't seem to be the case.

If this is a bug in nginx it may be an idea to completely disable certificate verification if possible?

Any advice is highly appreciated.

share|improve this question

1 Answer 1

SSL uses DNS for verification. Use a local DNS caching server or host files installed on the nginx server.

share|improve this answer
    
I'm always willing to learn. Why is this downvoted? I realize it's probably too simple an answer for someone with 1000 sites but others might benefit. A web search for "slow ssl startup slow dns" returns Apache and other webserver docs with this same answer. DNS performance is probably not the answer to this specific question but it is a known issue that can cause slow web server startup. –  joe Jun 4 '11 at 21:37

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.