An Ops Win: Cutting DynamoDB's TLS Handshake Latency with AWS-LC
In 2022 I swapped the cryptographic library under DynamoDB’s TLS termination from OpenSSL 1.0.2 to AWS-LC and deployed it to every AWS region with zero downtime, on a database serving hundreds of billions of requests an hour. Median handshake time dropped 12–35% by region, and FIPS endpoints dropped as much as 80%. This is the internal ops-win announcement rewritten for the public, including what made it hard — modifying Nginx source against a new crypto API, a legacy build system, Amazon’s deployment machinery, and cryptography where mistakes are quiet — and the two ways the rollout bit back.