One of the core security goals of Docker's Swarm mode is to be secure by default. To achieve that, when a new Swarm gets created it generates a self-signed Certificate Authority (CA) and issues short-lived[1] certificates to every node, allowing the use of Mutually Authenticated TLS for node-to-node communications. Unfortunately, and much to the annoyance of every infrastructure engineer, there is
![Hitless TLS Certificate Rotation in Go](https://cdn-ak-scissors.b.st-hatena.com/image/square/10ac2401aabc3a296a633b77b73596ded1406811/height=288;version=1;width=512/https%3A%2F%2Fblog.diogomonica.com%2Fcontent%2Fimages%2F2018%2F08%2Fload-balancer-hitless-rotation-1-1.png)