security.ssl.reload: When set to 'true', the keystore and truststore directories are monitored for changes and automatically reload the SSL Engine Factory with the updated keystore/truststore files. The files must keep their original names and paths. Defaults to 'false'.

interface LocalFSWatchServiceListener {
    void onWatchStarted(Path realDirectoryPath) {}
    void onFileOrDirectoryCreated(Path relativePath) {}
    void onFileOrDirectoryDeleted(Path relativePath) {}
    void onFileOrDirectoryModified(Path relativePath) {}
}

public class FileSystemCertificateWatchService extends Thread {
    public void run() {
        try (WatchService watcher = FileSystems.getDefault().newWatchService()) {
            for (String directoryPath : directoryPaths) {
                Path realDirectoryPath = Paths.get(directoryPath).toRealPath();
                realDirectoryPath.register(watcher, ENTRY_CREATE, ENTRY_DELETE, ENTRY_MODIFY);
                onWatchStarted(realDirectoryPath);
            }
            while (true) {
                for (WatchEvent<?> watchEvent : watchKey.pollEvents()) {
                // Manage watch events
                }
            }
    }
 }  

// Register callbask and list of paths
public registerWatchedPath(LocalFSWatchServiceListener callback, Path[] pathsToWatch)

public class CustomSSLEngineProvider implements SSLEngineProvider {

    private final SSLContextLoader sslContextLoader;

    public CustomSSLEngineProvider(ActorSystem system) {
        ...
        sslContextLoader = new SSLContextLoader(sslTrustStore, sslProtocol, securityConfig);
        FileSystemCertificateWatchService fileSystemWatchService = new FileSystemCertificateWatchService(...);
        fileSystemWatchService.launch();
    }

    ...

    private SSLEngine createSSLEngine(TLSRole role) {
        return createSSLEngine(sslContextLoader.creaeSSLEngine(), role);
    }

    private SSLEngine createSSLEngine(SSLEngine engine, TLSRole role) {
        ...
        return engine;
    }

}  

public class SSLContextLoader implements LocalFSWatchServiceListener {
    private volatile SSLContext sslContext;

    public SSLContextLoader(String sslTrustStore, String sslProtocol, Config securityConfig) {
        ...
        loadSSLContext();

    }  
    // Set dirty atomic bool to false and regenerate SSLContext
    void synchronized loadSSLContext()


    // Check dirty atomic bool before creating the engine
    // reload SSLContext if needed
    public SSLEngine createSSLEngine()

    void onWatchStarted(Path realDirectoryPath) {}
    void onFileOrDirectoryCreated(Path relativePath) {}
    void onFileOrDirectoryDeleted(Path relativePath) {}
    // Set dirty atomic bool to true
    void onFileOrDirectoryModified(Path relativePath) {} 
}

public class SSLUtils {
    ...
    @Nullable
    private static SslContext createInternalNettySSLContext(
            Configuration config,
            boolean clientMode,
            SslProvider provider)
            throws Exception {
        ...
        ReloadableJdkSslContext reloadableJdkSslContext =
                new ReloadableJdkSslContext(config, clientMode, provider);
        if (config.get(SecurityOptions.SSL_RELOAD)) {
	     // register path and callback to LocalFSWatchService
        }
        return reloadableJdkSslContext;
    }
    ...
    @Nullable
    public static SslContext createRestNettySSLContext(
            Configuration config, boolean clientMode, ClientAuth clientAuth, SslProvider provider)
            throws Exception {
        ...
        ReloadableSslContext reloadableSslContext =
                new ReloadableSslContext(config, clientMode, clientAuth, provider);
	  if (config.get(SecurityOptions.SSL_RELOAD)) {
	     // register path and callback to LocalFSWatchService
        }
        return reloadableSslContext;
    }
}  

public class ReloadableSslContext extends SslContext implements LocalFSWatchServiceListener {
    protected volatile SslContext sslContext;

    public ReloadableSslContext(
            Configuration config, boolean clientMode, ClientAuth clientAuth, SslProvider provider)
            throws Exception {
        ...
        loadContext();
    }


    void onWatchStarted(Path realDirectoryPath) {}
    void onFileOrDirectoryCreated(Path relativePath) {}
    void onFileOrDirectoryDeleted(Path relativePath) {}
    // Set dirty atomic bool to true
    void onFileOrDirectoryModified(Path relativePath) {}


    // load ssl context here
    protected synchronized void loadContext() throws Exception
}

public class ReloadableJdkSslContext extends ReloadableSslContext {
    public ReloadableJdkSslContext(Configuration config, boolean clientMode, SslProvider provider)
            throws Exception {
        super(config, clientMode, ClientAuth.NONE, provider);
    }

    // load ssl context here
    @Override
    protected synchronized void loadContext() throws Exception
}

public class BlobServer extends Thread
        implements BlobService,
                BlobWriter,
                PermanentBlobService,
                TransientBlobService,
                LocallyCleanableResource,
                GloballyCleanableResource {
public BlobServer(Configuration config, Reference<File> storageDir, BlobStore blobStore)
            throws IOException {
	 ...
	 blobServerSocket = new BlobServerSocket(config, backlog, maxConnections);
        ...
        if (config.get(SecurityOptions.SSL_RELOAD) && SecurityOptions.isInternalSSLEnabled(config)
                && config.get(BlobServerOptions.SSL_ENABLED)) {
           // Register path and callback
        }
}  

public class BlobServerSocket implements LocalFSWatchServiceListener {
    private ServerSocket serverSocket;    
    private boolean firstCreation = true;

    public BlobServerSocket(Configuration config, int backlog, int maxConnections)
            throws IOException {
        serverPortRange = config.get(BlobServerOptions.PORT);
        createSocket();
    }

    // Check dirty atomic bool before creating the engine
    // recreate the socket if needed
    // and provide the server socket 
    public ServerSocket getServerSocket()


    void onWatchStarted(Path realDirectoryPath) {}
    void onFileOrDirectoryCreated(Path relativePath) {}
    void onFileOrDirectoryDeleted(Path relativePath) {}
    // Set dirty atomic bool to true
    void onFileOrDirectoryModified(Path relativePath) {}


    // Will manage creation of socket
    private synchronized void createSocket() throws IOException
}