[Question] TLS certificate rotation

[t-yrka]

What is the recommended way of performing TLS certificate rotation with gunicorn?

Based on https://github.com/benoitc/gunicorn/blob/master/gunicorn/sock.py#L219 it seems (by default) the certificate is picked up on each request, so the gunicorn should automatically use the newest one available (and it works fine based on my testing). But I've not found this mentioned anywhere in the docs - is it an undocumented feature(?), or we shouldn't rely on this?

I was going to use the HUP signal to reload the workers, but it seems redundant when the certificates are not pre-loaded.

[chadr123]

@benoitc Hello. I'm also interested in this topic. Could you take a look at this question? :D

[benoitc]

certificates are not cached yet. If in the future it will this will be documented. I think it's safe anyway to force that reload when you rotate SSL certificates so you make sure that future changes are covered.