Rewritten 2026-08-10. The original framing claimed a running stream could not
be given new credentials or a new peer identity. That was wrong, and the
correction narrows this to an ergonomic gap rather than a capability one.
What is actually true
Both TLS adapters store the pointer they are given and dereference it on every
Open: CaBundlePath, ClientCertChainPath, ClientKeyPath, the Mbed TLS
CaChain / Rng / ClientCertChain / ClientKey handles, and ServerName
alike. The OpenSSL stream rebuilds its SSL_CTX in Open; the Mbed TLS stream
frees its ssl_config in Close and re-applies policy in Open.
So an integrator who owns the buffer or the handle can change any of it while the
stream runs — write new PEM to the same path, re-parse into the same
mbedtls_x509_crt, rewrite the name in their own buffer — call
SolidSyslogSender_Disconnect, and the next connection uses it.
A device issued new credentials over the air can use them without restarting.
That requirement is met. docs/tls.md states it as an obligation and both
platform pages now document the mechanism, including the sequencing the handle
model requires.
What is left
No change detection. The destination has one: SolidSyslogEndpointFunction
pulls host and port and SolidSyslogEndpointVersionFunction is polled every
Send, so the sender re-pulls and reconnects on its own when something moves.
The TLS stream has no equivalent, so an integrator who rotates a credential must
know to force the reconnection themselves.
Nothing breaks without it. It is an asymmetry in how two runtime-reconfigurable
things are handled, and closing it would let credential rotation work the way
re-homing already does.
Shape, if it is done
An optional version function on the TLS stream config, polled on the same terms
as the endpoint's — cheap, pure, monotonic — with NULL meaning "I will call
Disconnect myself", which keeps it additive rather than breaking.
Not in scope
Redirecting a stream at a differently allocated handle or a second path. An
integrator can design around it, nobody has asked for it, and it was the invented
requirement this issue originally rested on.
Rewritten 2026-08-10. The original framing claimed a running stream could not
be given new credentials or a new peer identity. That was wrong, and the
correction narrows this to an ergonomic gap rather than a capability one.
What is actually true
Both TLS adapters store the pointer they are given and dereference it on every
Open:CaBundlePath,ClientCertChainPath,ClientKeyPath, the Mbed TLSCaChain/Rng/ClientCertChain/ClientKeyhandles, andServerNamealike. The OpenSSL stream rebuilds its
SSL_CTXinOpen; the Mbed TLS streamfrees its
ssl_configinCloseand re-applies policy inOpen.So an integrator who owns the buffer or the handle can change any of it while the
stream runs — write new PEM to the same path, re-parse into the same
mbedtls_x509_crt, rewrite the name in their own buffer — callSolidSyslogSender_Disconnect, and the next connection uses it.A device issued new credentials over the air can use them without restarting.
That requirement is met.
docs/tls.mdstates it as an obligation and bothplatform pages now document the mechanism, including the sequencing the handle
model requires.
What is left
No change detection. The destination has one:
SolidSyslogEndpointFunctionpulls host and port and
SolidSyslogEndpointVersionFunctionis polled everySend, so the sender re-pulls and reconnects on its own when something moves.The TLS stream has no equivalent, so an integrator who rotates a credential must
know to force the reconnection themselves.
Nothing breaks without it. It is an asymmetry in how two runtime-reconfigurable
things are handled, and closing it would let credential rotation work the way
re-homing already does.
Shape, if it is done
An optional version function on the TLS stream config, polled on the same terms
as the endpoint's — cheap, pure, monotonic — with
NULLmeaning "I will callDisconnectmyself", which keeps it additive rather than breaking.Not in scope
Redirecting a stream at a differently allocated handle or a second path. An
integrator can design around it, nobody has asked for it, and it was the invented
requirement this issue originally rested on.