There may be two major reasons for changing a certificate. 1. Ordinary rotation, for example, due to expiration. In this case I would like to have a 100% high availiability. Existing sessions would use the old keys, the new sessions will use new encryption keys. 2. My private keys had been stolen and I want to drop all the exsting connections and reestablish those with the new keys.
How does the haproxy behave?
A reverse proxy accepts requests from a client, and forwards it to the relevant front end servers and returns the response back as well.
Once the proxy is restarted and if bound to the correct certificate thumbprint in the .cfg it should serve with the new pub/priv key pair.
The stale pages delivered will stay as is until it is reloaded.