Skip to content

tiproxy: add note about reloading certificates once an hour (#21171) #21286

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ti-chi-bot merged 3 commits into from
Jan 21, 2026
Merged

tiproxy: add note about reloading certificates once an hour (#21171) #21286

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
3afea57
This is an automated cherry-pick of #21171
qiancai Jan 19, 2026
b409a2e
resolve conflicts
qiancai Jan 20, 2026
2fd23c0
Update enable-tls-between-components.md
qiancai Jan 20, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 7 additions & 0 deletions enable-tls-between-components.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -223,7 +223,14 @@ summary: 了解如何为 TiDB 集群内各组件间开启加密传输。
## 证书重新加载

- 如果 TiDB 集群部署在本地的数据中心，TiDB、PD、TiKV、TiFlash、TiCDC 和各种 client 在每次新建相互通讯的连接时都会重新读取当前的证书和密钥文件内容，实现证书和密钥的重新加载，无需重启 TiDB 集群。
<<<<<<< HEAD
- 如果 TiDB 集群部署在自己管理的 Cloud，TLS 证书的签发需要与云服务商的证书管理服务集成，TiDB、PD、TiKV、TiFlash、TiCDC 组件的 TLS 证书支持自动轮换，无需重启 TiDB 集群。
=======

- TiProxy 每小时会从磁盘重新加载一次证书。

- 如果 TiDB 集群部署在自己管理的 Cloud，TLS 证书的签发需要与云服务商的证书管理服务集成，TiDB、PD、TiKV、TiFlash、TiCDC、TiProxy 组件的 TLS 证书支持自动轮换，无需重启 TiDB 集群。
>>>>>>> 173f948c50 (tiproxy: add note about reloading certificates once an hour (#21171))

## 证书有效期

Expand Down
4 changes: 4 additions & 0 deletions tiproxy/tiproxy-configuration.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -215,6 +215,10 @@ server_configs:

### security

> **注意：**
>
> TiProxy 每小时会从磁盘重新加载一次证书。因此，磁盘上证书文件的变更最多可能需要一小时才能生效。

在 `[security]` 部分有四个名称不同的 TLS 对象，它们共享相同的配置格式和字段，但是不同名称对象的字段解释可能不同。

```toml
Expand Down