I'm wanting to make a site as fast as possible and as part of that will be using multiple sub-domains to essentially grow the number of concurrent connections in a browser.

My question is this: how can I avoid having to do SSL negotiation for each sub-domain? If I use a wildcard certificate (or SAN) can/will the SSL session established with the primary www. domain be reused for the sub-domains to avoid the added latency of renegotiating the SSL connection?

The entire site will be behind SSL and it will have 2-3 additional sub-domains like media., static. etc. Using NGINX.

  • Don't bother with the subdomain. Just turn on HTTP2. – Michael Hampton Oct 31 '16 at 18:58
  • Even so there are other reasons behind using different sub-domains so I am still interested in the answer. – winston Oct 31 '16 at 20:40
  • Out of interest, what are the other reasons? – Tero Kilkanen Nov 1 '16 at 2:03

I don't think you can avoid taking the hit of SSL negotiation for each sub-domain.

The HTTPS connection must be established individually for each sub-domain. For all the client knows, those different sub-domains could be hosted anywhere, on different servers, in different countries. While the client technically could determine all sub-domains lead to the same IP address, it cannot and should not assume all sub-domains are being hosted by the same server process.

Furthermore, the connections will be coming in at different times, and the HTTPS key exchange process isn't designed to coordinate the kind of sharing of information between encrypted streams that you're hoping for.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.