Chapter 56 — TLS and certificate operations: expiry, chains, SNI, rotation

Build it in Go (30 min) — rotate a certificate with zero downtime

Restarting a server to load a new certificate drops connections. Go's tls.Config.GetCertificate hook avoids that: it's called during every handshake, so the server can switch certificates by swapping a pointer. New connections get the new certificate, and existing connections finish on the old one.

// certreload: rotate a TLS certificate with zero downtime (Chapter 56).
//
// The server never holds "the" certificate. tls.Config.GetCertificate is
// called during every handshake, so swapping an atomic pointer changes the
// certificate for all NEW connections while existing ones carry on untouched.
//
//	go run ./certreload            # generates two self-signed certs and rotates between them
package main

import (
	"crypto/ecdsa"
	"crypto/elliptic"
	"crypto/rand"
	"crypto/tls"
	"crypto/x509"
	"crypto/x509/pkix"
	"fmt"
	"math/big"
	"net"
	"net/http"
	"sync/atomic"
	"time"
)

type certStore struct {
	cur atomic.Pointer[tls.Certificate]
}

// GetCertificate runs inside every handshake. It can also choose by SNI
// (hello.ServerName) -- that is how one IP serves many certificates.
func (s *certStore) GetCertificate(hello *tls.ClientHelloInfo) (*tls.Certificate, error) {
	return s.cur.Load(), nil
}

func main() {
	store := &certStore{}
	store.cur.Store(selfSigned("generation-1"))

	ln, err := net.Listen("tcp", "127.0.0.1:0")
	if err != nil {
		panic(err)
	}
	srv := &http.Server{
		Handler:   http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) { w.Write([]byte("ok\n")) }),
		TLSConfig: &tls.Config{GetCertificate: store.GetCertificate, MinVersion: tls.VersionTLS12},
	}
	go srv.ServeTLS(ln, "", "") // empty paths: certificates come from GetCertificate
	addr := ln.Addr().String()

	fmt.Println("serving:", whoServes(addr))
	// In production this would be triggered by a file watcher, SIGHUP, or a
	// secret-manager callback after renewal. Load and VALIDATE first, then swap.
	next := selfSigned("generation-2")
	store.cur.Store(next)
	fmt.Println("rotated. new connections now see:", whoServes(addr))
}

func whoServes(addr string) string {
	// InsecureSkipVerify only because our demo certs are self-signed;
	// never do this in real clients.
	c, err := tls.Dial("tcp", addr, &tls.Config{InsecureSkipVerify: true})
	if err != nil {
		return err.Error()
	}
	defer c.Close()
	leaf := c.ConnectionState().PeerCertificates[0]
	return fmt.Sprintf("CN=%s serial=%s expires=%s", leaf.Subject.CommonName, leaf.SerialNumber, leaf.NotAfter.Format(time.DateOnly))
}

func selfSigned(cn string) *tls.Certificate {
	key, _ := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
	serial, _ := rand.Int(rand.Reader, big.NewInt(1<<62))
	tmpl := &x509.Certificate{
		SerialNumber: serial,
		Subject:      pkix.Name{CommonName: cn},
		DNSNames:     []string{"localhost"},
		NotBefore:    time.Now().Add(-time.Hour),
		NotAfter:     time.Now().Add(90 * 24 * time.Hour),
		KeyUsage:     x509.KeyUsageDigitalSignature,
		ExtKeyUsage:  []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
	}
	der, err := x509.CreateCertificate(rand.Reader, tmpl, tmpl, &key.PublicKey, key)
	if err != nil {
		panic(err)
	}
	return &tls.Certificate{Certificate: [][]byte{der}, PrivateKey: key}
}

$ go run ./certreload
serving: CN=generation-1 serial=2779963337554967105 expires=2027-01-01
rotated. new connections now see: CN=generation-2 serial=2047191123025242675 expires=2027-01-01

What to notice:

• atomic.Pointer makes the swap safe while thousands of handshakes run concurrently, with no lock on the hot path.
• Validate before you swap. In production, load the new pair with tls.LoadX509KeyPair, parse the leaf, and check that the names, expiry, and key match. Only then store it. A bad certificate loaded hot is an instant outage.
• hello.ServerName is the SNI. Serving many domains from one IP means a map lookup here, which is what Caddy, Traefik, and Kubernetes ingress controllers do.
• Go's golang.org/x/crypto/acme/autocert package plugs ACME into this same hook: it obtains and renews Let's Encrypt certificates automatically.

Exercises:

1. Add a file watcher: reload when cert.pem/key.pem change on disk (or on SIGHUP), with validation and a log line showing old and new serial numbers.
2. Combine it with Chapter 29's tlsinspect: run tlsinspect -expiry-days 30 against every endpoint in a list. That list is your certificate inventory.
3. Do the Go plan's zero-downtime rotation (Day 54) and mTLS with identity extraction (Day 41) next.