reload certificates after every minute

[soloturn]

current implementation can be made to watch certificate and reload on change. that sounds a little complex, and has edge cases, like symbolic links. can it be not made to reload the cert every minute or so? the overhead is minimal, and in most cases time based relaod is sufficient.

https://spring.io/blog/2023/11/07/ssl-hot-reload-in-spring-boot-3-2-0

[wilkinsona]

The code has already been written and, as far as we know, it's working well and hasn't resulted in a big maintenance burden. As such, I don't think the complexity is too high and the edge cases have not (yet at least) been problematic. Given that watching is more efficient and appears to function well, what benefit to users would there be in schedule-based reloading?

[spring-projects-issues]

If you would like us to look at this issue, please provide the requested information. If the information is not provided within the next 7 days this issue will be closed.

[soloturn]

currently it is broken. file watcher checkslast_modified of symlink (which doesn't change) and thus it does not work. and - if this edge case is fixed, another one will pop up. that stuff is file system dependend., on how stuff is mounted etc etc. rebooting and restarting can confuse timings. if one moves in a different file it might get confused. there is so many edge cases, where current implementation breaks.

[wilkinsona]

A problem with symlinks was fixed in 3.3.8 and 3.4.2.

I don’t think we should make a change here based on assumed problems for which there’s no evidence. We can always reconsider if it becomes apparent that the maintenance burden of the current approach is too high.

[soloturn]

@wilkinsona thank you for your welcoming and encouraging messages. you make people live and suffer with the springboot project, let them open a ticket, invest some time, and then brush it aside :) with the argument "hypothetical", while the next error is implemented right into #43586 it does not watch the link any more. if the location chagnes, it won't get it. or am i reading wrong?