uWSGI and Upstream HTTPS: Certificate Validation and DNS Resolution

Answering the Core Questions

1. Performance impact of --https-to-verify

• Certificate chain validation is performed once per TLS session by OpenSSL.
• Because uWSGI keeps a TLS session cache, the verification call is executed only for the first handshake of each session.
• On modern CPUs the additional verify call costs <1 ms, which is negligible compared to the baseline TLS handshake (~5–10 ms) and application logic.
• In high‑scale deployments where TLS session reuse is disabled, the overhead can become noticeable, but this is a configuration issue rather than a uWSGI bug.

2. Native DNS re‑resolution for upstream hosts

• uWSGI resolves the --https-to hostname once at process start and caches the IP.
• There is no flag or runtime command that forces the router to re‑resolve the hostname while the process is running.
• Typical workarounds are:
  1. Send SIGHUP to trigger a reload (which re‑reads the config and re‑resolves).
  2. Use an external script to update the --https-to value and then send SIGHUP.
  3. Place the upstream behind a stable DNS name with a long TTL, or use a load balancer that presents a fixed IP.

Why the Behavior Exists

uWSGI prioritises deterministic routing and avoids the cost of repeated DNS lookups for every request. The router is designed to be lightweight and predictable, so it deliberately caches the resolution until a process reload.

Practical Verification Steps

1. Measure overhead:

   # run with and without --https-to-verify
   $ ab -n 1000 -c 50 http://localhost:8080/ > output.txt
   # compare average latency
   

2. Confirm DNS caching:

   # change upstream DNS record
   $ nslookup upstream.example.com
   # check uWSGI log for IP
   $ grep upstream /var/log/uwsgi/uwsgi.log
   # change DNS again and restart uWSGI to see new IP
   

3. Check TLS session reuse:

   # capture traffic
   $ tcpdump -i eth0 host upstream.example.com -w capture.pcap
   # analyze with Wireshark; look for repeated ClientHello with same Session ID
   

Missing Diagnostic Detail

To refine the recommendation, please let us know whether TLS session reuse is currently enabled in your uWSGI build. If it is disabled, the --https-to-verify flag may introduce a measurable latency penalty that could influence your deployment strategy.