From High Performance Browser Networking by Ilya Grigorik:
- Upgrade TLS libraries to latest release, and (re)build servers against them.
- Enable and configure session caching and stateless resumption.
- Monitor your session caching hit rates and adjust configuration accordingly.
- Configure forward secrecy ciphers to enable TLS False Start.
- Terminate TLS sessions closer to the user to minimize roundtrip latencies.
- Use dynamic TLS record sizing to optimize latency and throughput.
- Ensure that your certificate chain does not overflow the initial congestion window.
- Remove unnecessary certificates from your chain; minimize the depth.
- Configure OCSP stapling on your server.
- Disable TLS compression on your server.
- Configure SNI support on your server.
- Append HTTP Strict Transport Security header.
Glen Scott
I’m a freelance software developer with 18 years’ professional experience in web development. I specialise in creating tailor-made, web-based systems that can help your business run like clockwork. I am the Managing Director of Yellow Square Development.
Follow Me:
