ECDHE based cipher suites tend to be slower than non-Forward Secrecy preserving variants. The mitigation for this is to deploy certificates containing ECDSA keys(preferably themselves signed by a CA with ECDSA). Because ECDSA is significantly faster than RSA, this results in comparable performance.

We should generate an ECDSA certificate with OpenSSL, check it in into jstests/libs(with instructions describing how to regenerate it), and write a JSTest which validates that we can use it as an tlsPEMKeyFile. If any platforms fail to load the certificate, we should bake that information into the test.