From 6d19bfb762bccae4425d0bb1f640a97e6d24d8dd Mon Sep 17 00:00:00 2001
From: shenlan <manbuzhe2009@qq.com>
Date: Thu, 2 Oct 2025 23:23:03 +0800
Subject: [PATCH] Ensure TLS chain is served without reloading certificates
 (#379)

---
 account/cmd/accountsvc/main.go | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/account/cmd/accountsvc/main.go b/account/cmd/accountsvc/main.go
index b6d2321..f1c1bef 100644
--- a/account/cmd/accountsvc/main.go
+++ b/account/cmd/accountsvc/main.go
@@ -222,6 +222,7 @@ var rootCmd = &cobra.Command{
 
 		logger.Info("starting account service", "addr", addr, "tls", useTLS)
 
+		var listenCertFile, listenKeyFile string
 		if useTLS {
 			if tlsSettings.RedirectHTTP {
 				go func() {
@@ -243,7 +244,15 @@ var rootCmd = &cobra.Command{
 				}()
 			}
 
-			if err := srv.ListenAndServeTLS(certFile, keyFile); err != nil {
+			if tlsConfig != nil && len(tlsConfig.Certificates) > 0 {
+				listenCertFile = ""
+				listenKeyFile = ""
+			} else {
+				listenCertFile = certFile
+				listenKeyFile = keyFile
+			}
+
+			if err := srv.ListenAndServeTLS(listenCertFile, listenKeyFile); err != nil {
 				if !errors.Is(err, http.ErrServerClosed) {
 					logger.Error("account service shutdown", "err", err)
 					return err