Does SurrealDB support hot-reloading of TLS certificates without server restarts?

Question

SurrealDB utilizes rustls for managing TLS connections and certificate validation. In production environments, maintaining high availability during certificate rotation is critical to avoid downtime.

Current documentation for SurrealDB (v1.x/v2.x) specifies the configuration of TLS certificates via the server startup flags, but it is unclear if the server monitors the filesystem for changes to these certificate files or if it loads them only once into memory during the initial boot sequence.

If the server does not automatically reload updated certificates, rotation requires a full process restart, which may impact cluster stability or client connectivity.

Technical Questions

Does the SurrealDB server automatically detect and reload TLS certificates when the underlying files are updated on disk?
  If hot-reloading is not supported, is there a documented administrative command or API endpoint to trigger a certificate refresh without restarting the process?

Zoha · Answer

Answer
SurrealDB does not support hot‑reloading of TLS certificates without a server restart.
Confirmed Facts

SurrealDB reads the TLS certificate and private key only once at process startup via the --tls-cert and --tls-key flags.
  The underlying rustls TLS stack used by SurrealDB does not provide a file‑watcher or automatic reload mechanism, and SurrealDB does not expose any runtime API to recreate the TLS acceptor.
  No administrative command, API endpoint, or signal (e.g., SIGHUP) is documented to trigger a certificate refresh without stopping and restarting the SurrealDB process.

Likely Explanation
Because the TLS configuration is loaded into memory during initialization and there is no background thread monitoring the certificate files for changes, any update to the cert/key files will not be seen by existing connections. The server must be stopped and started again to load the new material.
Steps to Rotate Certificates

Place the new certificate and private key files at the paths specified by --tls-cert and --tls-key (or update the existing files in‑place).
  Stop the SurrealDB server process.
  Start the server again with the same TLS flags; it will load the updated credentials.

Missing Diagnostic Detail
If you terminate TLS at a front‑end proxy or load balancer (e.g., NGINX, Envoy, HAProxy) instead of directly in SurrealDB, hot‑reload can be handled there, eliminating the need to restart SurrealDB. Are you using SurrealDB as the TLS termination point, or do you have a reverse proxy in front of it?

Does SurrealDB support hot-reloading of TLS certificates without server restarts?

Technical Questions

1 answer

Answer

Confirmed Facts

Likely Explanation

Steps to Rotate Certificates

Missing Diagnostic Detail

Your perspective belongs here.

0 question comments