Documentation
¶
Overview ¶
Package certreloader provides automatic TLS certificate reloading from disk. It periodically checks and reloads cert/key pairs so that certificate rotation does not require a process restart.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type CAReloader ¶
type CAReloader struct {
// contains filtered or unexported fields
}
CAReloader manages a CA certificate pool with automatic periodic reloading from disk. It is safe for concurrent use.
On reload failure, the last successfully loaded pool is preserved and continues to be used for client certificate verification.
func NewCAReloader ¶
func NewCAReloader(ctx context.Context, caFile string, clock Clock) *CAReloader
NewCAReloader creates a CAReloader that immediately loads the CA certificates from disk and starts a background goroutine to periodically reload them. The background goroutine exits when ctx is cancelled.
type CertReloader ¶
type CertReloader struct {
// contains filtered or unexported fields
}
CertReloader manages a single certificate/key pair with automatic periodic reloading. It is safe for concurrent use.
On reload failure, the last successfully loaded certificate is preserved and continues to be served. This follows the same pattern used by gRPC-Go's advancedtls pemfile watcher, nginx, and Envoy: a transient disk error should not take down TLS serving when a valid certificate is already in memory.
func New ¶
func New(ctx context.Context, certFile, keyFile string, clock Clock) *CertReloader
New creates a CertReloader that immediately loads the cert/key pair from disk and starts a background goroutine to periodically reload it. The background goroutine exits when ctx is cancelled.
func (*CertReloader) GetCertificate ¶
func (r *CertReloader) GetCertificate(_ *tls.ClientHelloInfo) (*tls.Certificate, error)
GetCertificate returns the current certificate for use as a tls.Config.GetCertificate callback (server-side).
func (*CertReloader) GetClientCertificate ¶
func (r *CertReloader) GetClientCertificate(_ *tls.CertificateRequestInfo) (*tls.Certificate, error)
GetClientCertificate returns the current certificate for use as a tls.Config.GetClientCertificate callback (client-side).
Source Files