有没有遇到个备域名手机解析特别慢的

ocsp 影响找到这个

For the status of Subscriber Certificates:

Prior to 2020-09-30: The CA SHALL update information provided via an Online Certificate Status Protocol at least every four days. OCSP responses from this service MUST have a maximum expiration time of ten days.

Effective 2020-09-30:

OCSP responses MUST have a validity interval greater than or equal to eight hours;
OCSP responses MUST have a validity interval less than or equal to ten days;
For OCSP responses with validity intervals less than sixteen hours, then the CA SHALL update the information provided via an Online Certificate Status Protocol prior to one-half of the validity period before the nextUpdate.
For OCSP responses with validity intervals greater than or equal to sixteen hours, then the CA SHALL update the information provided via an Online Certificate Status Protocol at least eight hours prior to the nextUpdate, and no later than four days after the thisUpdate.

apache 参数
Default: SSLStaplingStandardCacheTimeout 3600
修改为 SSLStaplingStandardCacheTimeout 864000

终于找到原因就是电信运营商 dns 的 ipv6 解析超时达到 10s+，，，以前习惯关闭本地日志哎

解决办法：
添加 aaaa 解析 0000:0000:0000:0000:0000:ffff:xxxx:xxxx (xxxx:xxxx 为 ipv4 转换 v6 地址)

建议 @dnspod 推出建议的默认解析参考提示

这问题太麻烦还是全网影响
好像 edns 策略更新，，以及缓冲区大小默认值 1232 报文值变动
https://dnsflagday.net/2020/index-zh-CN.html



行动: 递归 DNS 运营者
对递归解析测来说，或多或少与权威的要求类似，即能够通过 TCP(53 端口)应答 DNS 查询，用固定的 EDNS 缓冲区大小 (大概 1232 字节)从而避免 IP 分片。记得要检查你的防火墙。
最重要的是，递归解析服务器必须要通过 TCP 重复查询，如果他们收到一个被截断的 UDP 应答报文（ TC 被设置为 1 ）！


行动: 权威 DNS 运营者
对于权威侧来说，需要你帮助做的是应答 DNS over TCP 的查询（ 53 端口）。同时检查你的防火墙！
你也应该使用一个固定的 EDNS 缓冲区大小，那样就不会造成分片。这里建议采用大概 1232 字节，但是这个取值仍然在讨论中。
最后，权威 DNS 服务器不可以发送超过查询报文中请求的 EDNS 缓冲区大小的报文!
现在你可以测试检查你的域名了！通过在下面输入你的域名，然后按 Test! 这个测试使用了 ISC 的 EDNS 合规性测试器，它会从所有通用合规性测试例中选择 edns512tcp 来测试。

补充 openssl 1.1.1k [25 Mar 2021]

Fixed an issue where an OpenSSL TLS server may crash if sent a maliciously
crafted renegotiation ClientHello message from a client. If a TLSv1.2
renegotiation ClientHello omits the signature_algorithms extension (where
it was present in the initial ClientHello), but includes a
signature_algorithms_cert extension then a NULL pointer dereference will
result, leading to a crash and a denial of service attack.

A server is only vulnerable if it has TLSv1.2 and renegotiation enabled
(which is the default configuration). OpenSSL TLS clients are not impacted
by this issue.
(CVE-2021-3449)
[Peter Kästle and Samuel Sapalski]

到这应该差不多了，，其实还有。。。

nginx Changes

Bugfix: in the eventport method.
Bugfix: HTTP/2 connections were immediately closed when using
"keepalive_timeout 0"; the bug had appeared in 1.19.7.
Feature: now, if free worker connections are exhausted, nginx starts
closing not only keepalive connections, but also connections in
lingering close.

感叹还是迭代版本至少半年测试的必要性