In case anyone find these kind of things interesting, I debugged an inefficiency in gnutls wrt importing many CA certificates, and blogged how I did it: http://blog.josefsson.org/2008/02/27/real-world-performance-tuning-with-callgrind/ /Simon