[GH-ISSUE #2946] [Feature Request] Hot reloading TLS certificates in FRPS

gitea-mirror commented

2026-05-05 13:30:56 -06:00

Owner

Copy link

Originally created by @splinter98 on GitHub (May 20, 2022).
Original GitHub issue: https://github.com/fatedier/frp/issues/2946

Describe the feature request

Currently in FRPS TLS certificates are only loaded during the initialisation of the server, so if the signed certificate expires or are replaced FRPS needs to be restarted which will break any client connections.

Looking at how other programs handle this there seems to be two main approaches.

Catch any SIGHUP signals sent to the FRPS process and reload the certificate
Watch the files and reload the files when they changed

The former seemed simpler to implement so I have a working version at: splinter98/frp on the ssh-renewal branch.

Describe alternatives you've considered

I've also considered looking implementing the file monitoring approach but this would introduce another 3rd party library dependency.

Affected area

Docs
Installation
Performance and Scalability
Security
User Experience
Test and Release
Developer Infrastructure
Client Plugin
Server Plugin
Extensions
Others

Originally created by @splinter98 on GitHub (May 20, 2022). Original GitHub issue: https://github.com/fatedier/frp/issues/2946 ### Describe the feature request Currently in FRPS TLS certificates are only loaded during the initialisation of the server, so if the signed certificate expires or are replaced FRPS needs to be restarted which will break any client connections. Looking at how other programs handle this there seems to be two main approaches. 1. Catch any SIGHUP signals sent to the FRPS process and reload the certificate 2. Watch the files and reload the files when they changed The former seemed simpler to implement so I have a working version at: [splinter98/frp](https://github.com/splinter98/frp/tree/ssh-renewal) on the ssh-renewal branch. ### Describe alternatives you've considered I've also considered looking implementing the file monitoring approach but this would introduce another 3rd party library dependency. ### Affected area - [ ] Docs - [ ] Installation - [ ] Performance and Scalability - [X] Security - [X] User Experience - [ ] Test and Release - [ ] Developer Infrastructure - [ ] Client Plugin - [X] Server Plugin - [ ] Extensions - [ ] Others

gitea-mirror added the

proposal

label 2026-05-05 13:30:56 -06:00

gitea-mirror commented

2026-05-05 13:30:59 -06:00

Author

Owner

Copy link

@keliansb commented on GitHub (Aug 20, 2024):

Would love to see this feature implemented!

@keliansb commented on GitHub (Aug 20, 2024): Would love to see this feature implemented!

gitea-mirror commented

2026-05-05 13:31:00 -06:00

Author

Owner

Copy link

@srekkas commented on GitHub (Apr 3, 2025):

Hi.

We need it too. I am testing if frps/c reloads certificates right now.

@srekkas commented on GitHub (Apr 3, 2025): Hi. We need it too. I am testing if frps/c reloads certificates right now.

gitea-mirror commented

2026-05-05 13:31:01 -06:00

Author

Owner

Copy link

@srekkas commented on GitHub (Apr 29, 2025):

Yep, it wont reload certificates. We use cert-manager to generate certificates and some automatic reload is must for both frps and frpc.

We can implement sidecar for frpc, which watch certificates and query config reload api, if it will reload certificates.
But what about frps, i do not want use external watcher and reload frps pod, additional config, updates etc...

@srekkas commented on GitHub (Apr 29, 2025): Yep, it wont reload certificates. We use cert-manager to generate certificates and some automatic reload is must for both frps and frpc. We can implement sidecar for frpc, which watch certificates and query config reload api, if it will reload certificates. But what about frps, i do not want use external watcher and reload frps pod, additional config, updates etc...

gitea-mirror commented

2026-05-05 13:31:01 -06:00

Author

Owner

Copy link

@srekkas commented on GitHub (Feb 5, 2026):

Hi, can it be done :)

@srekkas commented on GitHub (Feb 5, 2026): Hi, can it be done :)

No Branch/Tag specified