Sure. "valid=3s" This probably can be relaxed, yes. The intent was to prevent grouping too many connections on the same 8 or so IP's we get in a single DNS query.

> ssl_session_cache shared:SSL:1m;
> ssl_session_timeout 86400;

This is a nice pointer, thank you. From nginx.org documentation "One megabyte of the cache contains about 4000 sessions." This should definitely be higher. Don't know if it will play into the outage I had, but good to get this set properly going forward.