Rotate certificates without restarting.

Works with any crypto/tls server. Each handshake gets a config built from the current snapshot, cached per reload, so it adds about 2.5 ns and no allocations. Session resumption keeps working across reloads. For HTTP/2, set NextProtos here.

srv := &http.Server{TLSConfig: r.ServerConfig(&tls.Config{
    ClientAuth: tls.RequireAndVerifyClientCert,
    NextProtos: []string{"h2", "http/1.1"},
})}
srv.ListenAndServeTLS("", "")

Every new connection gets a fresh config with the current roots and client certificate, and crypto/tls verifies the server. If the transport uses an HTTPS proxy, ConfigureTransport returns ErrProxyConfigured, because http.Transport skips the custom dialer for proxied requests. Use Config mode there.

tr := &http.Transport{ForceAttemptHTTP2: true}
if err := r.ConfigureTransport(tr, nil); err != nil {
    log.Fatal(err)
}
client := &http.Client{Transport: tr}

// Or for raw dials:
dial := r.DialTLSContext(&tls.Config{ServerName: "db.internal"})

Transport credentials for grpc-go, in a separate module so the core stays dependency-free. New connections pick up reloads; existing ones keep the certificates they started with.

import "github.com/rossedman/keyload/grpccreds"

srv := grpc.NewServer(grpc.Creds(grpccreds.New(r, grpccreds.WithTLSConfig(&tls.Config{
    ClientAuth: tls.RequireAndVerifyClientCert,
}))))

conn, err := grpc.NewClient(addr, grpc.WithTransportCredentials(grpccreds.New(r)))

For libraries that take a *tls.Config and nothing else. keyload sets InsecureSkipVerify and verifies the server in VerifyConnection with exactly the options crypto/tls uses, on every handshake. ServerName is required. CI checks it against crypto/tls on 2,000 generated chains.

cfg, err := r.ClientConfig(&tls.Config{ServerName: "api.internal"})
if err != nil {
    log.Fatal(err)
}
tr := &http.Transport{Proxy: http.ProxyFromEnvironment, TLSClientConfig: cfg}