Skip to content

Add connection max-lifetime for proactive mTLS certificate rotation #1342

Description

@brucearctor

Context

Follow-up to #1338 / #1340.

HTTP/2 connections are long-lived and multiplexed. With keep_alive_while_idle(true) (the default), a healthy connection may never drop and reconnect, meaning the client_cert_resolver is only invoked on the initial handshake.

For users with short-lived certificates (e.g., Vault certs with 1–24h TTLs), rotation only takes effect when the connection happens to drop (server restart, network blip, keepalive timeout failure).

Proposal

Add a max_connection_lifetime: Option<Duration> to ConnectionOptions (or KeepAliveOptions) that forces periodic reconnection. For example, setting it to 12h would ensure new certificates are picked up at least every 12 hours.

This mirrors patterns in other gRPC clients:

  • gRPC-Go has MaxConnectionAge on the server side
  • Java gRPC has maxConnectionAge / maxConnectionAgeGrace
  • The client-side equivalent would force a graceful channel recreation

Impact

This benefits all mTLS users, not just those using the dynamic cert resolver.

References

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Fields

    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions