HTTP/2 push lets the server send a resource before the browser asks, which sounds like it should remove a round trip and in practice often sends something the…
The header tells browsers to refuse plain HTTP to this host for the given duration, and they honour it from cache — so shortening the max-age only affects…
HTTP/2 does not require encryption in the specification and does in every browser, so in practice it arrives with the certificate. nginx 1.9.5 replaced the SPDY module with…
Without stapling, the browser checks whether a certificate has been revoked by contacting the issuing authority itself — an extra DNS lookup and request, to a third party,…
certbot renew checks every certificate it manages and does nothing for those with more than thirty days left. Running it often is therefore free, and running it rarely…