The TLS handshake timeout that dropped API calls during peak hours

Under heavy traffic spikes, clients reported intermittent cURL error 28: Operation timed out during the TLS handshake phase, even though application response times were under fifty milliseconds.

# /etc/nginx/nginx.conf
# Enable TLS session resumption and ticket caching:
ssl_session_cache shared:SSL:20m;
ssl_session_timeout 4h;
ssl_session_tickets on;

# Optimize TCP backlog for TLS handshakes:
# In sysctl.conf: net.core.somaxconn = 4096

When clients open hundreds of non-keepalive HTTPS connections, the CPU cost of full cryptographic handshakes overwhelms worker cores. Enabling a 20MB shared SSL session cache allows 92% of returning clients to resume sessions in a single round-trip.