The client can decipher the data only once it has received a full record over SSL. The record size can have significant impact on the page load time performance of the application. No limitation on record size means that clients might have to download up to 16KB of data before starting to process them, whereas very small records incur a larger overhead due to record framing. The suggestion is to configure the TLS record size to fit into a single TCP segment, this can improve page load times on browsers located over high latency or low bandwidth networks.
- ref: http://www.igvita.com/2013/10/24/optimizing-tls-record-size-and-buffering-latency/^{Image Removed}
Status: https://issues.apache.org/jira/browse/TS-2365^{Image Removed}

2. Configurable session time

Session size is configurable, whereas application can not specify a session time out threshold. The default is 300 seconds. In some cases, applications need to reduce or increase expiration for the internal session or session ticket, it's good to be configurable.
Status: https://issues.apache.org/jira/browse/TS-2416^{Image Removed}

3. Release memory for idle ssl connection

When we no longer need a read buffer or a write buffer for a given SSL, then release the memory we were using to hold it. Released memory is either appended to a list of unused RAM chunks on the SSL_CTX, or simply freed if the list of unused chunks would become longer than SSL_CTX->freelist_max_len, which defaults to 32. Using this flag can save around 34K per idle SSL connection. This flag has no effect on SSL v2 connections, or on DTLS connections.
ref: http://www.openssl.org/docs/ssl/SSL_CTX_set_mode.html^{Image Removed}
Status: https://issues.apache.org/jira/browse/TS-2413^{Image Removed}

When verifying peer certificates, A few customers expect to obtain the specific cert data (i.e. subject, issuer info) and forward them to origin servers. It's better to expose API to extract peer certificate data.
Status: https://issues.apache.org/jira/browse/TS-2210^{Image Removed}

...