How to Handle mTLS Certificate Rotation in Python

import ssl
import tempfile
import datetime
from pathlib import Path


class MTLSContext:
    def __init__(self, cert_path, key_path, ca_path):
        self.cert_path = Path(cert_path)
        self.key_path = Path(key_path)
        self.ca_path = Path(ca_path)
        self.context = None
        self.last_loaded_mtime = None

    def load(self):
        self.context = ssl.create_default_context(ssl.Purpose.CLIENT_AUTH)
        self.context.load_cert_chain(self.cert_path, self.key_path)
        self.context.load_verify_locations(self.ca_path)
        self.last_loaded_mtime = self.cert_path.stat().st_mtime

    def maybe_reload(self):
        current_mtime = self.cert_path.stat().st_mtime
        if current_mtime != self.last_loaded_mtime:
            print(f"[{datetime.datetime.now():%H:%M:%S}] Detected cert change, reloading...")
            self.load()
            return True
        return False


if __name__ == "__main__":
    with tempfile.TemporaryDirectory() as tmp:
        cert = Path(tmp) / "server.crt"
        key = Path(tmp) / "server.key"
        ca = Path(tmp) / "ca.crt"

        # Mock initial certificates
        cert.write_text("-----BEGIN CERTIFICATE-----\nMOCK-V1\n-----END CERTIFICATE-----")
        key.write_text("-----BEGIN PRIVATE KEY-----\nMOCK-KEY\n-----END PRIVATE KEY-----")
        ca.write_text("-----BEGIN CERTIFICATE-----\nMOCK-CA\n-----END CERTIFICATE-----")

        ctx_mgr = MTLSContext(cert, key, ca)
        ctx_mgr.load()
        print(f"Initial mTLS context loaded (mtime={ctx_mgr.last_loaded_mtime:.0f})")

        # Simulate cert rotation
        cert.write_text("-----BEGIN CERTIFICATE-----\nMOCK-V2-ROTATED\n-----END CERTIFICATE-----")

        # Check for reload
        ctx_mgr.maybe_reload()
        print(f"Active mTLS context after rotation check: ready")