A small note on TLS session reuse

Handshakes are expensive, and we were doing a full one on nearly every request. Not because anything was misconfigured in an exciting way, but because the session cache was shared per worker and each worker was effectively cold.

Turning on a shared cache and giving it a sane timeout moved the p99 more than a week of application-level work had. That is not a flattering thing to admit, but it is the sort of change that pays for itself immediately.

The caveat is that session reuse interacts with certificate rotation in ways that are easy to forget. If you rotate keys and expect old sessions to die instantly, check what your server actually does with tickets first.