Dynamic TLS Client Certificate Reload for MySQL Persistence Layer

[leenabhandari]

Moving from temporalio/proposals#109

Author: Leena Bhandari

Summary of the feature being proposed

Problem: Temporal already supports dynamic TLS client-cert reload on the RPC/internode layer. The MySQL persistence layer still loads certs once at startup into a static tls.Config.Certificates field. When the cert is rotated on disk, the connection pool keeps reusing connections authenticated with the old cert and they fail with invalid connection until the process is restarted. Issue temporalio/temporal#1162 was closed by temporalio/temporal#1415 but only the RPC layer was addressed.

Proposed fix: Replace the one-time tls.Config.Certificates assignment with a GetClientCertificate callback so new handshakes pick up the rotated cert. To keep disk reads off the connection hot path, serve the cert from a small cache refreshed periodically mirroring the pattern in temporalio/temporal#1415

What value does this feature bring to Temporal?

Zero-downtime cert rotation for persistence mTLS- eliminates the need for process restart which is currently the only recovery.

Are you willing to implement this feature yourself?

Yes