TopolearnConnection setup costs several round trips, and certificate errors are among the most common production incidents.
HTTP/1.1 and HTTP/2 run over TCP, a reliable, ordered byte stream. Opening a TCP connection takes a three-way handshake (SYN, SYN-ACK, ACK): one round trip before any data. TCP then retransmits lost packets and controls congestion, starting slowly and speeding up, so new connections are slower than warm ones.
HTTPS is HTTP inside TLS, which provides:
- encryption: eavesdroppers on Wi-Fi or ISPs can't read or modify traffic;
- integrity: tampering is detected;
- authentication: the server proves it owns the domain with a certificate.
The TLS 1.3 handshake adds one round trip: client and server agree on keys (ephemeral Diffie-Hellman) and the server sends its certificate. The client checks that the certificate is valid for the hostname, not expired, and chains to a certificate authority in its trust store. Let's Encrypt issues free certificates automatically through the ACME protocol, and certificate lifetimes are shrinking toward weeks, so automate renewal.
So a fresh HTTPS request costs DNS + TCP (1 RTT) + TLS (1 RTT) before the request even leaves. With 100 ms of latency that's 200+ ms of pure setup. That's why connection reuse (keep-alive) matters, and why HTTP/3 merges the transport and TLS handshakes.
Browsers mark plain HTTP as "Not secure" and many features (service workers, geolocation, HTTP/2 in browsers) require HTTPS. Serve everything over HTTPS and redirect HTTP to it.
Example
# Time each phase of a request
$ curl -so /dev/null https://example.com -w \
"dns %{time_namelookup}s\ntcp %{time_connect}s\ntls %{time_appconnect}s\nfirst byte %{time_starttransfer}s\n"
dns 0.012s
tcp 0.045s # TCP handshake done (cumulative)
tls 0.091s # TLS handshake done
first byte 0.140s
# Inspect the certificate chain and expiry
$ openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null \
| openssl x509 -noout -subject -issuer -enddateRemember
- HTTPS = HTTP over TLS over TCP
- TCP handshake = 1 RTT; TLS 1.3 handshake = 1 more RTT
- Certificates prove domain ownership via a CA chain
- Reuse connections and automate certificate renewal
Watch out for
- Letting a certificate expire because renewal was manual.