Multiple domain names per certificate performance

That's probably just ECDSA vs. RSA. The private key won't get sent as part of the connection, of course.

Sounds about right, it's really just that fullchain being sent that I'm talking about. It's not sent in PEM format, either, but yeah, it's probably adding up to a kilobyte or so. Some people do need to worry about an extra kilobyte or two that gets added to each and every connection, though.

Just as an anecdote, When Let's Encrypt made their current set of intermediates, they actually got a new domain name lencr.org to use for the URLs that they have to embed within it, because even just saving a few bytes on those URLs, times the number of times the Let's Encrypt's intermediates need to be transmitted a day, can add up to a really large bandwidth savings for the Internet as a whole.

Neither am I. Just letting you know the considerations that some people have to take into account.

5 Likes