How to reduce cloudfront origin connection ssl time

Question

We have an elasticbeanstalk application with alb speaking to an ec2 instance in Virginia. The application latency is in itself less than 100ms but the initial connection (dns + tcp + ssl) is taking 600ms and 300ms is for the ttfb(of which 100ms is due to the app).So overall its taking 900ms.
The subsequent requests are taking 300ms.

To optimise and reduce the initial connection time, we used cloudfront in front of the alb without any caching as ours is dynamic content.
So we used cloudfront just for ssl termination.That helped in reducing the initial connection time to 120ms.But now the ttfb increased to 800ms.
My assumption is that cloudfront is setting up a new connection(ssl) to the origin server for every request and that is increasing the latency and is now worse than without having cloudfront.  
So is using cloudfront for ssl termination and without any caching is not useful as its making the situation worse?

How can we reduce the cloudfront to origin connection times.I increased the keepalive time on cloudfront to 60s, but still its only helping for certain requests and some requests are still taking the regular time(with connection setup to origin) ?
How can I measure whats happening between cloudfront and origin ?

Without ideally increasing the servers, how can I best achieve reduced latency in the above case.

SMP · Answer

I can only provide a partial answer on how to measure what is happening between Cloudfront and origin.

If you enable access logging on the ALB, you will be able to determine TLS session reuse (value `session-reused` in the `chosen_cert_arn` field) and, by approximation, TCP connection reuse (HTTP keepalive) by matching up the `client_ip`, `client_port`, `target_ip`, `target_port` tuple.

How to reduce cloudfront origin connection ssl time

Relevant content