Feature Request: Support for Hot TLS Certificate Rotation

[suliao]

Feature Request: Support for Hot TLS Certificate Rotation

Description

Is there currently support for hot TLS certificate rotation in Spring gRPC? Hot TLS certificate rotation refers to the ability to update/replace TLS certificates without restarting the gRPC server.

Use Case

In production environments, TLS certificates need to be rotated periodically for security reasons or when they expire. Restarting servers to apply new certificates causes service disruption. Hot certificate rotation would allow for certificate updates while maintaining service availability.

Current Understanding

Based on reviewing the codebase and documentation:

• Spring gRPC supports TLS configuration through Spring Boot's SSL bundle configuration
• Custom TrustManager implementations are possible (as documented in detail)
• However, there doesn't appear to be a mechanism to reload/rotate certificates at runtime

Potential Implementation Approaches

If this feature doesn't exist yet, potential approaches might include:

1. A certificate watcher that monitors certificate files for changes
2. An API to programmatically update certificates at runtime
3. Integration with Spring Boot's SSL bundle refresh mechanisms (if available)

Question

1. Is hot TLS certificate rotation currently supported?
2. If not, are there plans to add this feature in the future?
3. Are there any workarounds or recommended approaches for certificate rotation without service disruption?

Thank you for your consideration.

[dsyer]

Hot TLS certificate reload is only implemented for Tomcat (and Webflux with Netty) - that's the way it works OOTB in Spring Boot. So you can definitely make it work with gRPC and Tomcat. If you want to implement something for the native gRPC server you'd have to copy the patterns in [Tomcat*, Netty*]WebServerFactory from Spring Boot - they register a listener for the bundle change event on startup. We can make a plan if you need it. If anyone wants to implement it then pull requests are more than welcome.

[HyunSangHan]

Hi, can I take a look at this PR? :)
It's interesting.

[suliao]

Yes, please make a plan. It's important. We tried gRPC on tomcat, the performance is not as good as native gRPC server.

[dsyer]

Hi, can I take a look at this PR? :)

Yes, of course.