Website Test Results - SSL Negotiation Question

[pmeenan]

With the 2.10 release I changed the default behavior for clearing the OS certificate caches.

Somewhere around 6 months ago I started clearing the OS certificate caches which cased SSL negotiation times to go up significantly for the IE agents that were running on Windows Vista or later (IE on XP does not do CRL/OCSP checks).

There was quite a bit of push-back because it was clearing all of the certificates, including the certs from the root providers so IE was validating things like verisign's root cert which is something that will hardly ever happen to end users.

The real world lies somewhere in between but I don't have a way to just clear the leaf certificates and it was skewing site's performance enough that it was hiding other issues so I made it an option on a per-test basis and it is disabled by default (it's available in the advanced settings if you want to re-enable it for a given test).