Hono: TLS certificate files of customer-facing endpoints should be reloaded regularly

[jnbsi]

TLS certificates might get renewed automatically (via ACME client) which results in changed Kubernetes secrets. The changes will be reflected instantly within the application containers (i.e. HTTP adapter) on the secret's mount point. The certificates which are accessible in those mount points should be reloaded by the application regularly (i.e. once per day) in order to reflect changes on the certificates without the need of restarting the container.

[sophokles73]

Are we talking about public certificates or self-signed ones? In the former case there shouldn't be any need for configuring a trust store on the clients (HTTP adapter) in the first place ...

[jnbsi]

I was talking about public certificates, issued by Let's Encrypt in our case.
It's not about the trust store but the certificate itself. Our ACME client will renew certificates (and the Kubernetes secrets) when it notices that the certificate will expire in a configured number of days. But without reloading the renewed certificate or restarting the pod, the changes will not be reflected on the application's endpoint.

[sophokles73]

Oh, I see. That makes sense. However, a new certificate will only be used by e.g. the HTTP adapter after re-binding the vert.x HTTP server to the port. This is basically the same as re-starting the pod so I wonder if it wouldn't be easier to simply re-start the pods periodically?

[sophokles73]

@jnbsi can this be closed?

[jnbsi]

Closed, topic will be solved on operations end.