Is it possible to update a tonic server's TLS identity for new connections "live", without tearing down the existing server?

[BatmanAoD]

Since TLS certificates expire, servers need a way to update their certificate periodically. Does tonic support a way to do this certificate-swapping without detaching from the listening port and setting up a new server on the same port?

[MukundaKatta]

Hot-swapping the server identity isn't supported on tonic::transport::Server directly — ServerTlsConfig is consumed at build time. Standard workaround: terminate TLS in a front proxy (nginx, Caddy, envoy) that handles cert rotation, and have tonic listen plaintext on localhost. If you need it inside the binary, wire rustls::server::ResolvesServerCert with a reloading resolver and use the hyper transport directly via Server::builder().with_tls(...) bypassing tonic's TLS helper.