Certificate reload for TURNS and DTLS listeners.
What problem this solves
WebRTC clients require valid TLS certificates for turns: and DTLS. Issuance
and renewal happen out of process (for example lego with DNS-01). This module
clears the OTP PEM cache and restarts secure listeners when operators or
automation install new files at the configured :certs paths.
Called by Certs.Watcher (polling) and Certs.SignalHandler (SIGHUP).
RFCs
Summary
Functions
@spec paths() :: [Path.t()]
Returns configured certificate file paths (cert, key, optional CA bundle).
Omits nil entries from :certs application env.
@spec reload() :: :ok
Clears the PEM cache and restarts secure (TLS/DTLS) listeners with fresh certs.