# Multiple SSL enabled hosts causes nginx to reload slowly

**URL:** <https://www.ruby-forum.com/t/multiple-ssl-enabled-hosts-causes-nginx-to-reload-slowly/207133>\
**Category:** NGINX\
**Created:** [May 19, 2011, 2:40am UTC](https://www.ruby-forum.com/t/multiple-ssl-enabled-hosts-causes-nginx-to-reload-slowly/207133 "2011-05-19T02:40:45Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![dubstep](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/cdc98d/32.png) [@dubstep](https://www.ruby-forum.com/u/dubstep)\
**Post date:** [May 19, 2011, 2:40am UTC](https://www.ruby-forum.com/t/multiple-ssl-enabled-hosts-causes-nginx-to-reload-slowly/207133/1 "2011-05-19T02:40:45Z")

</div>

Hi,

I’ve set up a ssl\_certificate and ssl\_certificate\_key directives on the  
http level of my nginx configuration. The problem I’m facing is that  
starting/reloading nginx is getting slower and slower as more hosts  
(server directives) are added. The server has roughly 1000 SSL-enabled  
hosts that inherits the ssl certificate directives.

I know nginx verifies the certificate when loading it, so I’m wondering  
if nginx checks the certificate each time an SSL enabled host inherits  
the shared certificate? If so, shouldn’t it only check the certificate  
once? According to  
[Configuring HTTPS servers](http://nginx.org/en/docs/http/configuring_https_servers.html) it should  
cause all hosts to inherit a single memory footprint, but this doesn’t  
seem to be the case.

If this is a bug in nginx it may be an idea to completely disable  
certificate verification if possible?

Any advice is highly appreciated.

Best,  
Rune

Posted at Nginx Forum:

> **[Multiple SSL enabled hosts causes nginx to reload slowly](https://forum.nginx.org/read.php?2,199166,199166#msg-199166)**
>
> Hi, I've set up a ssl\_certificate and ssl\_certificate\_key directives on the http level of my nginx configuration. The problem I'm facing is that starting/reloading nginx is getting slower and slower as more hosts (server directives) are added. The...

---

<div class="post-metadata">

**Author:** ![runesoerensen](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/e95f7d/32.png) [@runesoerensen](https://www.ruby-forum.com/u/runesoerensen)\
**Post date:** [May 19, 2011, 12:43pm UTC](https://www.ruby-forum.com/t/multiple-ssl-enabled-hosts-causes-nginx-to-reload-slowly/207133/2 "2011-05-19T12:43:14Z")

</div>

Hello!

On Wed, May 18, 2011 at 08:40:15PM -0400, runesoerensen wrote:

> the shared certificate? If so, shouldn’t it only check the certificate  
> once? According to  
> [Configuring HTTPS servers](http://nginx.org/en/docs/http/configuring_https_servers.html) it should  
> cause all hosts to inherit a single memory footprint, but this doesn’t  
> seem to be the case.
> 
> If this is a bug in nginx it may be an idea to completely disable  
> certificate verification if possible?
> 
> Any advice is highly appreciated.

Quick look suggests that time is taken mostly here in  
ngx\_http\_ssl\_module.c:

```
/* a temporary 512-bit RSA key is required for export versions of 

```

MSIE \*/  
if (ngx\_ssl\_generate\_rsa512\_key(&conf-\>ssl) != NGX\_OK) {  
return NGX\_CONF\_ERROR;  
}

As export versions of MSIE are rare and hardly supported nowadays  
anyway, you may want to just nuke this code as a workaround.

I’ll take a look at this further as time permits.

Maxim D.

---

<div class="post-metadata">

**Author:** ![runesoerensen](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/e95f7d/32.png) [@runesoerensen](https://www.ruby-forum.com/u/runesoerensen)\
**Post date:** [July 27, 2011, 4:49am UTC](https://www.ruby-forum.com/t/multiple-ssl-enabled-hosts-causes-nginx-to-reload-slowly/207133/3 "2011-07-27T04:49:32Z")

</div>

Hi Maxim,

Thanks for looking into this - I may apply the fix you propose sometime  
in the future.

The solution I ended up with was kind of weird. I simply put the  
ssl\_certificate related directives inside a “faux” server directive,  
that’s also the first server directive containing ssl directives. As  
nginx picks the first one it finds, the correct certificate is still  
being inherited by other server directives. This caused the startup time  
to be drastically reduced.

Rune

Posted at Nginx Forum:

> **[Re: Multiple SSL enabled hosts causes nginx to reload slowly](https://forum.nginx.org/read.php?2,199166,212974#msg-212974)**
>
> Hi, I've set up a ssl\_certificate and ssl\_certificate\_key directives on the http level of my nginx configuration. The problem I'm facing is that starting/reloading nginx is getting slower and slower as more hosts (server directives) are added. The...

---

<div class="post-metadata">

**Author:** ![runesoerensen](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/e95f7d/32.png) [@runesoerensen](https://www.ruby-forum.com/u/runesoerensen)\
**Post date:** [July 27, 2011, 9:26am UTC](https://www.ruby-forum.com/t/multiple-ssl-enabled-hosts-causes-nginx-to-reload-slowly/207133/4 "2011-07-27T09:26:58Z")

</div>

Hello!

On Tue, Jul 26, 2011 at 10:48:49PM -0400, runesoerensen wrote:

> to be drastically reduced.  
> Just FYI: Igor recently committed a change to generate temporary  
> 512-bit RSA keys on the fly and only when needed. This should  
> resolve problems with slow startup in all cases.

Maxim D.