letsencrypt
Load test ocsp-responder's CPU performance
It would be useful to know how many rps per core an ocsp-responder can serve, if it's not limited by its datastore performance. To do that, I propose to stand up a local ocsp-responder using an InMemorySource, construct an appropriate OCSP request (e.g. with checkocsp), and then hammer the ocsp-responder instance using a load testing tool like wrk. We can then divide the max response rate by the number of CPUs, and make appropriate twiddles for CPU speed.
One note on the proposed method here: a lot of the CPU-intensive operations that the responder does (parsing response, hashing issuer names, comparing things) are actually done by the OcspFilter, which is only used by the DbSource, not the InMemorySource. This can be worked around by doing the OCSP refactoring I've thought about some that makes the filter mandatory for all sources, or by doing actual lookups in a local MariaDB or something.
