Geo Key Manager: Setting up a service for scale

What this post added

This post details the scaling challenges and architectural evolution of Cloudflare's Geo Key Manager service. It describes how increased demand, particularly from API traffic and geographical data residency requirements (like GDPR), led to performance degradation and TLS handshake failures. The post explains the interaction between the initial TLS termination service, keynotto (a Rust-based key signing service), and gokeyless (a Go-based Keyless SSL keyserver). It highlights issues like head-of-line blocking in keynotto's connection handling and the architectural decisions made to optimize RSA key signatures using Rust and BoringSSL, contrasting it with Go's performance characteristics. The post also touches upon the use of worker pools in gokeyless and the decision to move gokeyless to BoringCrypto for FIPS validation.