[Question] TLS certificate rotation

[t-yrka]

What is the recommended way of performing TLS certificate rotation with gunicorn?

Based on https://github.com/benoitc/gunicorn/blob/master/gunicorn/sock.py#L219 it seems (by default) the certificate is picked up on each request, so the gunicorn should automatically use the newest one available (and it works fine based on my testing). But I've not found this mentioned anywhere in the docs - is it an undocumented feature(?), or we shouldn't rely on this?

I was going to use the HUP signal to reload the workers, but it seems redundant when the certificates are not pre-loaded.