Problem on a specific domain (archive.is)

[grimman]

Essentially, the problem is that the https-everywhere extension adds a full minute to the loading time of archive.is, in addition to locking up the browser entirely (maxing out a CPU core in the process).

I'm using the latest version of Firefox (release channel)

[mnordhoff]

@fuglede It's not a ruleset thing, it's the SSL Observatory. OP's screenshot shows ~60 seconds of time spent in findRootInChain and observe. And it happens on both archive.is (2 rulesets, Archive.is and Google APIs) and on archive.li (0 rulesets, yet). And it doesn't happen if you disable the SSL Observatory.

I checked Firefox release and nightly on Linux x86-64. Refreshing OP's page maxes out one CPU core for about 40 seconds with SSL Observatory on, or 10 seconds with it off. (Exact numbers from Nightly.)

There are literally 498-500 resources on the page (#s 499 and 500 are Google Analytics, which is used on archive.is but not archive.li). Maybe they just have semi-pathological certificates, exacerbated by the extreme number of requests involved?

Archive.is uses a seemingly-ordinary Comodo RSA certificate. https://www.ssllabs.com/ssltest/analyze.html?d=archive.is
Archive.li uses CloudFlare, with a seemingly-ordinary Comodo ECDSA certificate. https://www.ssllabs.com/ssltest/analyze.html?d=archive.li

[fuglede]

@mnordhoff: Ah, thanks for looking into that.

[philippelatulippe]

I experience this issue on another website too, but it only hangs the browser for 5 seconds. That site also uses cloudflare with a comodo certificate, and loads hundreds of resources. Not sure why findRootInChain is so slow, but it would probably be better if shouldSubmit wasn't called for every resource that is loaded, and instead its return value cached somehow.

A quick survey of https sites I visit shows that the SSL Observatory often adds 500-2000ms to load time, so it would be great if this was fixed. :)

I'm running Firefox 46.0.1 on OSX 10.11.14

[Giltyhub]

@J0WI can u close this issue as it's related to the no longer present SSL observatory feature (quote:)

It's not a ruleset thing, it's the SSL Observatory.