[endre]

also, old haproxy process (with opened connections) still does checks which might be undesirable at scale.

as such we try to avoid reloading haproxy as much as possible. you can even renew a cert on-the-fly uploading the new cert via the admin socket.