From 8bbec9f28afa196470900c51958483a6c09723c0 Mon Sep 17 00:00:00 2001
From: Tushar-TG-14 <tushar.sharma@tigergraph.com>
Date: Mon, 31 Aug 2026 20:48:56 +0530
Subject: [PATCH 1/2] DOC-3321: Add SSL certificate rotation instructions for
 Nginx [4.3]

---
 .../admin-portal/pages/components/nginx.adoc  | 37 +++++++++++++++++++
 1 file changed, 37 insertions(+)

diff --git a/modules/admin-portal/pages/components/nginx.adoc b/modules/admin-portal/pages/components/nginx.adoc
index 2710c5e..b6665a0 100644
--- a/modules/admin-portal/pages/components/nginx.adoc
+++ b/modules/admin-portal/pages/components/nginx.adoc
@@ -73,6 +73,43 @@ Since configuration change requires restarting the server service, a pop-up box
 After clicking the btn:[OK] button, the configuration changes and server restart process will take several moments.
 You will be notified after all the process is completed.
 
+=== Gracefully rotating the Nginx SSL certificate
+
+To rotate the Nginx SSL certificate and key without interrupting active connections, update the certificate and key configuration, apply the changes, and then gracefully reload Nginx.
+
+. Update the Nginx SSL certificate and key:
++
+[source,console]
+----
+gadmin config set Nginx.SSL.Cert @/path/to/certificate.pem
+gadmin config set Nginx.SSL.Key @/path/to/key.pem
+gadmin config set Nginx.SSL.Enable true
+----
+
+. Apply the configuration changes:
++
+[source,console]
+----
+gadmin config apply -y
+----
+
+. Gracefully reload Nginx on all nodes:
++
+[source,console]
+----
+nginx_path=$(gadmin config get System.AppRoot)/nginx/sbin/nginx
+prefix_path=$(gadmin config get System.LogRoot)/nginx
+conf_path=$(gadmin config get System.DataRoot)/configs/nginx/conf/nginx.conf
+grun nginx "$nginx_path -p $prefix_path -c $conf_path -s reload"
+----
+
+[IMPORTANT]
+====
+Do not run `gadmin restart -y nginx` when rotating the certificate if you need to preserve active connections. Use the `grun` command above to perform a graceful Nginx reload.
+====
+
+. Verify that Nginx is serving the new certificate.
+
 [WARNING]
 ====
 Downgrading from HTTPS to HTTP (turning off SSL) will cause a user authentication failure.

From 91069d81d19dd87d63e963180caa5d881f8824f3 Mon Sep 17 00:00:00 2001
From: Tushar-TG-14 <tushar.sharma@tigergraph.com>
Date: Mon, 31 Aug 2026 20:58:47 +0530
Subject: [PATCH 2/2] Update nginx.adoc

---
 modules/admin-portal/pages/components/nginx.adoc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/admin-portal/pages/components/nginx.adoc b/modules/admin-portal/pages/components/nginx.adoc
index b6665a0..54a8fe3 100644
--- a/modules/admin-portal/pages/components/nginx.adoc
+++ b/modules/admin-portal/pages/components/nginx.adoc
@@ -69,7 +69,7 @@ Click btn:[Self Signed] to fill in the information to generate a self-signed cer
 
 image::ssl-uploading.png[]
 
-Since configuration change requires restarting the server service, a pop-up box will appear to confirm whether to restart the service.
+For configuration changes made through the Admin Portal, a pop-up box will appear asking whether to restart the service.
 After clicking the btn:[OK] button, the configuration changes and server restart process will take several moments.
 You will be notified after all the process is completed.