Question about SSL Certificate Hot-Reloading in Hysteria 2

[gaofeilongdev]

Hi community,

I'm using Hysteria 2 and updating my SSL certificates (acme.sh) every few days. I noticed in the source code (app/cmd/server.go) that hyConfig.TLSConfig.GetCertificate = certLoader.GetCertificate is used, which seems to support dynamic loading.

I just want to confirm: If my external script replaces the fullchain.cer and private.key files on the disk, will Hysteria 2 automatically read the new certificate for new connections without needing a systemd restart?

Thanks!

[cookesan]

Yes for the local tls.cert / tls.key path, with the usual caveat that it applies to new TLS handshakes.

The server config intentionally uses:

hyConfig.TLSConfig.GetCertificate = certLoader.GetCertificate

and the comment says this is so users can update the cert without restarting the server. LocalCertificateLoader.GetCertificate() checks the cert and key file modification times, reloads the key pair when either mtime changes, and keeps using the cached certificate if the files are temporarily unavailable or a reload fails.

So replacing fullchain.cer and private.key on disk should be enough for new connections, as long as your script updates the files atomically and the mtimes change. Existing connections will keep whatever certificate was used when their TLS session was established.