On a small VPS, the RSA or ECDSA signing operation in a TLS 1.3 handshake is often the most expensive thing your CPU does per request. Full handshakes from cold clients can consume 5–15% of a single vCPU at just a few hundred requests per second. The fix is not a larger instance — it is session resumption, ticket key rotation, and OCSP stapling configured so that the expensive asymmetric work happens once per client rather than once per connection. This is the configuration and the measurement to prove it worked.<\/p>\n\n\n\n
In TLS 1.3, a full handshake costs one or two signature operations on the server plus a key exchange. An abbreviated handshake via PSK resumption costs a symmetric operation and no signature at all. Measure the difference directly:<\/p>\n\n\n\n
# openssl speed: know your signature cost before tuning\nopenssl speed -seconds 2 rsa2048 ecdsap256 # legacy paths\n# on a 1-vCPU KVM guest: rsa2048 ~50-120 sign\/s, ecdsap256 ~600-1500 sign\/s\n\n# full handshake vs resumption, per-connection cost\nfor i in 1 2 3; do\n openssl s_client -connect example.com:443 -tls1_3 -no_ticket \/dev\/null \\\n | grep -i 'New, TLSv1.3'\n openssl s_client -connect example.com:443 -tls1_3 \/dev\/null \\\n | grep -i 'Reused, TLSv1.3'\ndone<\/code><\/pre>\n\n\n\nTrack server-side resumption rate rather than guessing. Nginx exposes it through the log format; Prometheus through nginx_vts<\/code> or the stub_status counters:<\/p>\n\n\n\n# nginx: add resumption indicators to the access log\nlog_format tls '$remote_addr $ssl_protocol $ssl_curve $ssl_session_reused '\n '$ssl_session_id \"$request\" $request_time';\naccess_log \/var\/log\/nginx\/tls.log tls;\n\n# what fraction of connections resumed?\nawk '{print $4}' \/var\/log\/nginx\/tls.log | sort | uniq -c | sort -rn\n# expect \"r\" (reused) to dominate for repeat visitors<\/code><\/pre>\n\n\n\nSession Tickets: Rotation Without Breaking Resumption<\/h2>\n\n\n\n
TLS 1.3 uses stateless session tickets, so no server-side cache is needed — but the ticket key must be shared across workers and rotated on a schedule (Nginx uses a 128-bit key plus a 4-byte name). The classic mistake is enabling tickets with the default single key and never rotating, which lets a stolen key decrypt recorded sessions indefinitely:<\/p>\n\n\n\n
# \/etc\/nginx\/nginx.conf\nssl_session_cache shared:SSL:20m; # 20 MB ~ 80k sessions per worker set\nssl_session_timeout 4h;\nssl_session_tickets on;\n\n# TLS 1.3 requires an explicit ticket key for stable resumption across\n# reloads and multi-worker setups on older nginx builds:\nssl_session_ticket_key \/etc\/nginx\/ticket.key; # 80 bytes, mode 0600\n\n# generate with correct entropy and permissions\nsudo head -c 80 \/dev\/urandom > \/etc\/nginx\/ticket.key\nsudo chmod 600 \/etc\/nginx\/ticket.key\nsudo chown root:root \/etc\/nginx\/ticket.key<\/code><\/pre>\n\n\n\nRotate the key on a schedule, keeping the previous key for one full ssl_session_timeout<\/code> window so in-flight sessions remain resumable:<\/p>\n\n\n\n#!\/bin\/bash\n# \/etc\/cron.monthly\/rotate-ticket-key\nset -euo pipefail\nKEY=\/etc\/nginx\/ticket.key\ncp -p \"$KEY\" \"${KEY}.old\"\nhead -c 80 \/dev\/urandom > \"$KEY.new\"\nchmod 600 \"$KEY.new\"; chown root:root \"$KEY.new\"\nmv \"$KEY.new\" \"$KEY\"\nnginx -t && systemctl reload nginx\n# remove the .old key after ssl_session_timeout has elapsed \u2014 nginx\n# keeps it in memory for the running generation only\nfind \/etc\/nginx -name 'ticket.key.old' -mtime +1 -delete<\/code><\/pre>\n\n\n\nOCSP Stapling: Remove the Client-Side Fetch<\/h2>\n\n\n\n
Without stapling, a client must contact the CA’s OCSP responder, adding a round trip and, more importantly for you, adding a dependency that fails when the responder is slow — a common cause of intermittent TLS stalls. Stapling embeds a signed, cached OCSP response in the handshake. Verify it works before and after:<\/p>\n\n\n\n
# \/etc\/nginx\/conf.d\/tls.conf\nssl_stapling on;\nssl_stapling_verify on;\nssl_trusted_certificate \/etc\/nginx\/ca-chain.pem; # full chain incl. root\nresolver 1.1.1.1 [2606:4700:4700::1111] valid=300s ipv6=off;\nresolver_timeout 5s;\n\n# verify: look for a non-empty \"OCSP Response Status: successful\"\nopenssl s_client -connect example.com:443 -status -servername example.com \/dev\/null \\\n | sed -n '\/OCSP Response Status\/,\/^---\/p'\n\n# if it says \"no response sent\", check the nginx error log \u2014 usually a\n# missing ssl_trusted_certificate or an unreachable resolver<\/code><\/pre>\n\n\n\n