Swap certificates in running server after renewal.

src/app.js

@@ -112,7 +112,7 @@ function startHttpsGateway() {
     });
   }));
 
-  return Promise.all(promises);
+  return Promise.all(promises).then(() => servers.https);
 }
 
 function startHttpGateway() {
@@ -307,9 +307,10 @@ function startGateway() {
         return startHttpGateway();
       }
 
-      return startHttpsGateway().then(() => {
+      return startHttpsGateway().then((server) => {
         TunnelService.hasTunnelToken().then(function(result) {
           if (result) {
+            TunnelService.setServerHandle(server);
             TunnelService.start();
           }
         });
@@ -341,7 +342,9 @@ if (config.get('cli')) {
 // function to stop running server and start https
 TunnelService.switchToHttps = function() {
   stopHttpGateway();
-  startHttpsGateway();
+  startHttpsGateway().then((server) => {
+    TunnelService.setServerHandle(server);
+  });
 };
 
 // This part starts our Service Discovery process.

src/certificate-manager.js

@@ -193,8 +193,10 @@ async function register(email, reclamationToken, subdomain, fulldomain,
 
 /**
  * Try to renew the certificates associated with this domain.
+ *
+ * @param {Object} server - HTTPS server handle
  */
-async function renew() {
+async function renew(server) {
   if (DEBUG) {
     console.debug('Starting renewal.');
   }
@@ -259,6 +261,13 @@ async function renew() {
     }
 
     writeCertificates(results);
+
+    if (server) {
+      const ctx = server._sharedCreds.context;
+      ctx.setCert(results.cert);
+      ctx.setKey(results.privkey);
+      ctx.addCACert(results.chain);
+    }
   } catch (err) {
     console.error('Renewal failed:', err);
   }

src/ssltunnel.js

@@ -29,6 +29,7 @@ const TunnelService = {
   connected: new Deferred(),
   pingInterval: null,
   renewInterval: null,
+  server: null,
 
   /*
    * Router middleware to check if we have a ssl tunnel set.
@@ -65,6 +66,11 @@ const TunnelService = {
     }
   },
 
+  // Set a handle for the running https server, used when renewing certificates
+  setServerHandle: function(server) {
+    this.server = server;
+  },
+
   // method that starts the client if the box has a registered tunnel
   start: function(response, urlredirect) {
     Settings.get('tunneltoken').then((result) => {
@@ -120,9 +126,10 @@ const TunnelService = {
           PushService.init(`https://${endpoint}`);
 
           // Try to renew certificates immediately, then daily.
-          CertificateManager.renew().then(() => {
-            this.renewInterval =
-              setInterval(CertificateManager.renew, 24 * 60 * 60 * 1000);
+          CertificateManager.renew(this.server).then(() => {
+            this.renewInterval = setInterval(() => {
+              CertificateManager.renew(this.server);
+            }, 24 * 60 * 60 * 1000);
           });
         }).catch(() => {});
       } else {