My setup 1) Linode $20/mo REE box (will bump up in production) 2) Nginx 3) RoR 3.0.3 4) SSL Through Geotrust. It is a "chained" cert but i don't believe this is the bottleneck.
thanks in advance...
http://journal.paul.querna.org/articles/2010/07/10/overclock...
Basically, unless you are certain you need it 4096 bit security, use a 2048 bit key (1024 is not secure anymore) and only include the minimum number of intermediate certs you can get away with. OSCP stapling doesn't seem worth it if it cause you to over flow the initial TCP window.
OCSP stapling is the best answer, although one can only staple a single response and many chains these days require two responses.
So a better answer is to get a CA which issues certificates with 24-48 hour validity and doesn't use an out of band revocation system. If you can find such a thing, please tell me where.