SAN Certs如何降低性能？

一些肤浅的testing似乎表明，我正在喂养一堆malarky。

我生成这样的证书：

 openssl genrsa -out www.domain.tld.key 2048 [kbrandt@alpine: ~/sancrt] openssl req -new -key www.domain.tld.key -out www.domain.tld.csr You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [AU]:US State or Province Name (full name) [Some-State]:NY Locality Name (eg, city) []:New York Organization Name (eg, company) [Internet Widgits Pty Ltd]:LOTA-SAN Organizational Unit Name (eg, section) []:SANSRUS Common Name (eg server FQDN or YOUR name) []:www.domain.tld Email Address []:[email protected] .... echo -n "subjectAltName=DNS:www.domain.tld," > www.domain.tld.cnf;for i in {1..2500}; do echo -n "DNS:www$i.domain.tld,"; done >> www.domain.tld.cnf #manually delete comma at the end of the .cnf openssl x509 -req -days 365 \ > -in www.domain.tld.csr \ > -signkey www.domain.tld.key \ > -text \ > -extfile www.domain.tld.cnf \ > -out www.domain.tld.crt Signature ok subject=/C=US/ST=NY/L=New York/O=LOTA-SAN/OU=SANSRUS/CN=www.domain.tld/[email protected] Getting Private key cat *.key *.crt > sillysan.pem 

当我尝试curl和wget我不能得到任何明显的差异：

 time curl -ssl3 --noproxy \* -D - --insecure http://www2500.domain.tld curl -ssl3 --noproxy \* -D - --insecure http://www2500.domain.tld 0.01s user 0.00s system 69% cpu 0.012 total 

结果与www vs www2500相同。 我想这可能是因为 – defecure完全绕过了检查，但现在我要给一个非常不科学的testing的标准印章：