Open
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
Adds support for parallel loading of ssl_multicert.yaml certificates, controlled by a new records.config setting, to speed up certificate (re)configuration in ATS’s TLS / QUIC certificate loaders.
Changes:
- Introduces
proxy.config.ssl.server.multicert.concurrency(records + docs) and threads the value throughSSLConfigParams. - Updates
SSLMultiCertConfigLoaderto optionally load multicert items in parallel usingstd::thread, with locking for sharedSSLCertLookupmutations. - Extends the gold test to cover the new parallel-loading behavior.
Reviewed changes
Copilot reviewed 8 out of 8 changed files in this pull request and generated 6 comments.
Show a summary per file
| File | Description |
|---|---|
| tests/gold_tests/tls/ssl_multicert_loader.test.py | Adds a new gold test section intended to validate parallel loading behavior. |
| src/records/RecordsConfig.cc | Registers the new proxy.config.ssl.server.multicert.concurrency record. |
| src/iocore/net/SSLUtils.cc | Implements the parallel multicert loading logic and adds locking around shared lookup mutation. |
| src/iocore/net/SSLConfig.cc | Reads the new concurrency record into SSLConfigParams and passes “first load” state into the loader. |
| src/iocore/net/QUICMultiCertConfigLoader.cc | Updates QUIC cert reload path to pass “first load” state into the loader. |
| src/iocore/net/P_SSLConfig.h | Adds configLoadConcurrency to SSLConfigParams. |
| include/iocore/net/SSLMultiCertConfigLoader.h | Updates loader API to accept firstLoad and adds _load_items() + mutex. |
| doc/admin-guide/files/records.yaml.en.rst | Documents the new configuration record and its behavior. |
zwoop
previously approved these changes
Mar 19, 2026
Contributor
zwoop
left a comment
There was a problem hiding this comment.
This generally looks good now, couple of nitpicks, at your discretion to address or not.
Change to just do a clamp as well if firstLoad
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds a new config proxy.config.ssl.server.multicert.concurrency
Defaults to 1 for single core usage, however even with that on first load it will use all cores for cert loading. After that it will use the specified value 0(auto)/1(default)/N(number of threads) when doing reloads of certs