Skip to content

Conversation

@xdecock
Copy link

@xdecock xdecock commented May 21, 2020

Basically,

loops a first time over certificates to create a map name => certs[], this allows for lookup of the possible certificates, which allows way faster matching.

@xdecock
Copy link
Author

xdecock commented May 21, 2020

well the rest of the slowness is linked to that part :

https://github.com/hlandau/acmetool/blob/master/storage/storage-fdb.go#L400

	actualKeyID, err := determineKeyIDFromKey(pk)
	if err != nil {
		return err
	}

Keeping that section solves our 1300 record in ~2Min CPU time, vs 13 seconds, without, i suspect the rand.Reader is the problem here, and can probably lead to entropy starvation on some server.

Could we add a switch to bypass this check?

The PR here, brought our response time down from 35 minutes.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

1 participant