I’ve done some research and here is what I’ve come up with:

IE has a well known bug whereby it doesn’t download resources over SSL if they have 0 cache expiry time. So the resources to be downloaded at all, you should set an expiry time in the future (this is true of IE6, I don’t know if it got fixed in IE7/8).

Firefox 2 doesn’t cache SSL content to disk by default, however version 3 seems to do so under some conditions.

My conclusion is: yes, it does introduce some scalability problems. In general, you can rely on it being cached during the browsing session, but not in between browsing sessions. As always, it is a tradeoff between security (which becomes more important as the use of wireless – an easy to sniff medium – becomes very widespread) and costs.

If you are running a public facing website then this will usually mean the difference between 1 page request for returning customers and 20 hits.

I would really consider putting some heavy disclaimers at the start of this article that it is only for people who aren’t interested in their website scaling.