Tests

HTTPS test

The Novabench HTTPS test measures how long it takes to open a real HTTPS connection to a target, broken down into each phase of the connection. It reports the negotiated TLS and certificate details, so you can see what a browser or app actually negotiates when it connects.

The HTTPS test is useful for diagnosing slow-to-load sites and checking whether DNS, TCP, or the TLS handshake is the bottleneck. It also confirms a server's certificate and protocol configuration and compares connection performance across targets. It runs on Windows, macOS, and Linux and needs no elevated permissions.

What the HTTPS test measures

Novabench times each connection in four phases:

Phase

What it measures

DNS

Time for the operating system resolver to look up the target host. Novabench does not bypass the OS cache, so this reflects what your applications actually experience.

TCP connect

Time to open the TCP socket to the resolved IP address.

TLS handshake

Time to complete the TLS handshake and establish the encrypted session.

Time to first byte

Time from the minimal request until the first response byte arrives.

Together these phases account for the full cost of starting an HTTPS request before any page content transfers.

Cold and warm samples

The test runs two sets of samples against each target: cold samples with TLS session resumption disabled, then warm samples with resumption allowed. A warm connection can reuse keys from an earlier session and skip part of the handshake. Comparing the two sets shows how much time resumption saves on repeat connections.

For each target, Novabench runs 5 cold samples followed by 5 warm samples, one at a time, with a short randomized delay between samples. An uncounted priming connection seeds the warm set, so the first measured warm sample can resume. Each target has a time budget of about 60 seconds, and each phase has a 10 second timeout.

Reading your results

The HTTPS section shows the target host, the port (when it is not 443), and the resolved IP address, followed by the key metrics.

Headline metrics

  • Time to first byte (cold): the median TTFB across cold samples.
  • Time to first byte (warm) and warm speedup: shown when the warm connection is meaningfully faster, with the time saved.
  • Slowest phase: which phase (DNS, TCP connect, TLS handshake, or first byte) takes the most time.
  • Diagnostic read: a plain-language summary that names the slowest phase and states whether session resumption helps, for example "TLS handshake is the slowest phase (142 ms). Session resumption saves 40 ms (28%)."

Charts

  • Timeline: grouped horizontal bars that show where each connection spends its time, cold compared to warm. This is the connection equivalent of a browser network waterfall.
  • Resumption savings: the per-phase time the warm connection saves compared to cold.

For every phase, Novabench records the median, minimum, maximum, and standard deviation across samples, along with the sample count, separately for cold and warm.

Protocol and certificate details

A separate connection collects the negotiated facts, shown in an expandable details table:

Detail

Description

ALPN

The negotiated application protocol (h2 or http/1.1).

TLS version

The negotiated TLS version, for example TLS 1.3.

Cipher suite

The negotiated cipher suite.

Certificate chain

The number of certificates in the presented chain.

Certificate expiry

Days until the leaf certificate expires.

Issuer

The certificate issuer common name.

Revocation checked

Whether an online revocation check ran, and how long it took, for example "Yes (85 ms)".

Novabench detects session resumption by observing the TLS handshake directly, rather than guessing. The test reads the ServerHello for a TLS 1.3 pre-shared-key extension, or a TLS 1.2 session-ID echo. When the handshake does not reveal resumption, Novabench reports it as unknown rather than assuming a value.

When a target fails

If a connection cannot complete, Novabench reports which phase failed:

Failure

Meaning

DNS failure

The host name did not resolve.

TCP refused

The target refused the connection on that port.

TCP timeout

The connection attempt timed out.

TLS failure

The TLS handshake did not complete.

HTTP failure

The connection opened, but no response byte arrived.

A target that fails partway still records the phases it completed, so a TLS failure still shows the DNS and TCP connect times that preceded it.

Configuration

Targets

By default, the HTTPS test targets novabench.com. On Plus, you can add custom targets (up to 10) to test connection negotiation to specific sites, APIs, or internal hosts. Each target accepts a host name with an optional port, in the form host or host:port. A target tree lets you select or exclude individual targets before you run the test.

The test needs no elevated permissions and runs the same way on Windows, macOS, and Linux.

Feature availability by plan

Feature

Free

Plus

HTTPS test (single default target)

Yes

Yes

Multiple custom targets (up to 10)

Yes

Cloud submission and sharing

Yes

Advanced results grid filtering

Yes