tls.Config GetClientCertificate for Proactive Credential Rotation

Quick Answer

Use a thread‑safe wrapper around GetClientCertificate that checks the certificate’s NotAfter date on every handshake. If the remaining lifetime is below a configurable threshold, reload the key pair from disk and replace the cached *tls.Certificate. The http.Transport will automatically use the updated tls.Config for new connections; no extra signal is required.

Why It Works

• The callback runs on every TLS handshake, so it can decide which certificate to present.
• Updating the tls.Config (or the certificate stored in it) is safe for concurrent use – the struct’s fields are read atomically during handshake.
• Because the transport does not cache the client certificate itself, simply updating the config guarantees the new cert is used for subsequent handshakes.

Recommended Pattern

1. Define a reloadable cert holder.
2. Guard the holder with a sync.RWMutex to allow concurrent reads and safe writes.
3. In GetClientCertificate, acquire a read lock, inspect cert.NotAfter, and if the time left is below threshold, upgrade to a write lock, reload the key pair, and replace the cached value.
4. Return the (possibly new) certificate to the handshake.
5. Optional: run a background goroutine that pre‑emptively reloads the cert threshold before expiry to avoid any race with the first handshake after the old cert expires.

Code Skeleton

type CertReloader struct {
    mu          sync.RWMutex
    certPath    string
    keyPath     string
    cert        *tls.Certificate
    threshold   time.Duration
}

func NewCertReloader(certPath, keyPath string, threshold time.Duration) (*CertReloader, error) {
    r := &CertReloader{certPath: certPath, keyPath: keyPath, threshold: threshold}
    if err := r.reload(); err != nil {
        return nil, err
    }
    return r, nil
}

func (r *CertReloader) reload() error {
    cr, err := tls.LoadX509KeyPair(r.certPath, r.keyPath)
    if err != nil {
        return err
    }
    r.mu.Lock()
    defer r.mu.Unlock()
    r.cert = &cr
    return nil
}

func (r *CertReloader) GetClientCertificate(_ *tls.CertificateRequestInfo) (*tls.Certificate, error) {
    r.mu.RLock()
    cert := r.cert
    r.mu.RUnlock()

    // Quick check – if the cert is about to expire, reload.
    if time.Until(cert.Leaf.NotAfter) < r.threshold {
        if err := r.reload(); err != nil {
            // Log and fall back to the old cert.
            log.Printf("cert reload failed: %v", err)
        } else {
            // After reload, fetch the new cert.
            r.mu.RLock()
            cert = r.cert
            r.mu.RUnlock()
        }
    }
    return cert, nil
}

// Usage
reloader, _ := NewCertReloader("/path/to/client.crt", "/path/to/client.key", 24*time.Hour)
transport := &http.Transport{TLSClientConfig: &tls.Config{GetClientCertificate: reloader.GetClientCertificate}}
client := &http.Client{Transport: transport}

Transport Refresh Note

The http.Transport does not cache the client certificate; it reads the tls.Config on each handshake. Therefore, simply updating the GetClientCertificate function (or the tls.Config it points to) is sufficient. If you replace the entire Transport instance, make sure to swap it in the http.Client atomically to avoid races.

What to Verify

• During a handshake, log cert.NotBefore and cert.NotAfter to confirm the callback sees the current cert.
• Replace the cert files on disk and trigger a handshake before the old cert expires; the new cert should appear in the log.

Missing Diagnostic Detail

What pre‑expiry window do you want to use for automatic reload (e.g., 24 h, 12 h, 1 h)? Adjusting threshold in the reloader changes the reload timing.