[tls] Allow refreshing TLS configuration information at runtime

[smklein]

Adds a refresh_tls method to HttpServer, which allows TLS information to be updated for a running server.

Fixes #491

[jclulow]

How does the mutex on the acceptor work if there are no inbound connections being made?

[smklein]

How does the mutex on the acceptor work if there are no inbound connections being made?

The acceptor exists independently of inbound connections. My addition of an Arc<Mutex<...>> is basically just a way of indicating: "within the HttpsAcceptor, which accept-s new connections and negotiates TLS, allow the acceptor to get replaced by a different value". If no inbound connections are being made, we simply aren't accepting anything -- this is the same with or without the mutex.

Note that the TlsAcceptor is constructed using the certificate chain + private key pair.

So, basically, refresh_tls keeps this HttpsAcceptor running, but just uses an acceptor from a new "cert chain / private key" pair. This doesn't impact any clients that have previously connected, but it does impact all new connections - which is behavior I tested.

Does that answer your question?

[jclulow]

Yes that makes sense thanks. I had missed that we are not blocking at that point waiting on a connection, because of the select loop it's inside that actually deals directly with the system-level sockets.

[ahl]

ship it

[ahl]

I may be mistaken, but I think this is the first breaking change in this list. If that's the case, can you please create two sections as below?

[smklein]

Sure, updated in 219ff7a

[smklein]

FYI @davepacheco , since this is a breaking change