Zero-Downtime TLS Certificate Live-Reloading with Generic Atomic Pointers

package main
 
import (
	"crypto/tls"
	"errors"
	"fmt"
	"sync/atomic"
)
 
type CertificateReloader struct {
	certPointer atomic.Pointer[tls.Certificate]
}
 
func NewCertificateReloader(initialCert tls.Certificate) *CertificateReloader {
	r := &CertificateReloader{}
	r.certPointer.Store(&initialCert)
	return r
}
 
func (r *CertificateReloader) SwapCertificate(newCert tls.Certificate) {
	r.certPointer.Store(&newCert)
}
 
func (r *CertificateReloader) GetCertificate(_ *tls.ClientHelloInfo) (*tls.Certificate, error) {
	cert := r.certPointer.Load()
	if cert == nil {
		return nil, errors.New("no valid tls certificate loaded")
	}
	return cert, nil
}
 
func main() {
	initial := tls.Certificate{}
	reloader := NewCertificateReloader(initial)
 
	config := &tls.Config{
		GetCertificate: reloader.GetCertificate,
	}
 
	reloader.SwapCertificate(tls.Certificate{})
	fmt.Printf("TLS GetCertificate hook dynamic reload verified: %v\n", config.GetCertificate != nil)
}