The SSL certificate went on and the site got slower
Enabling HTTPS should cost you a few milliseconds. When it costs seconds, the certificate is rarely the culprit on its own.
Enabling HTTPS should cost a handshake. When a site gets dramatically slower right after a certificate goes on, the certificate is usually innocent and something around it is not.
Where the time actually goes
A TLS handshake on a properly configured server adds a few milliseconds and then session resumption makes even that mostly disappear. Seconds of new load time do not come from encryption. They come from what the deployment changed around it.
The usual suspects
- A redirect chain. The insecure address redirects to the secure one, which redirects to the canonical host, which redirects to a trailing slash. Every hop is a full round trip, and on mobile a round trip is expensive.
- An incomplete certificate chain. If an intermediate certificate is missing, some clients go and fetch it themselves before rendering anything. This is invisible in a desktop browser that has already cached it.
- Mixed content being rewritten on the fly. A plugin filtering the entire page output on every request to swap insecure asset URLs is doing real work on every uncached page load.
- The cache quietly emptying. Changing the protocol changes cache keys. The site is not slower, it is uncached, and it stays that way if the warming never happened.
- HTTP/2 not actually enabled. HTTPS was the prerequisite, and the server was never switched over, so a site tuned around multiplexing is still opening connections one at a time.
How to tell which one
Measure the phases separately rather than looking at a single score. Time the DNS lookup, the connection, the TLS negotiation and the time to first byte independently. One of those numbers will be carrying the increase, and that tells you where to look. A tool that gives you a grade out of 100 will not.
The one that catches people
A staging environment that never had HTTPS. Every measurement taken before the deployment was on a different protocol path than every measurement taken after it, so the comparison was never like for like. Fix that first, then measure again; sometimes the regression is smaller than it looked, and sometimes it is entirely real and now you can see it clearly.