You don't need to atomically replace 2 files. Renewing the certificate does not entail changing the private key, so unless you toss away the private key yoursel

You don't need to atomically replace 2 files. Renewing the certificate does not entail changing the private key, so unless you toss away the private key yourself you won't get a mismatched key and certificate situation. It only needs to update the certificate, a single operation, which can be done atomically. Certificates are also renewed ahead of time so a previous connection still having the old cert is not an issue.