The actual problem is you can't atomically replace a directory with another one. You have to do tricks where you have a symlink to the real directory and atomic

The actual problem is you can't atomically replace a directory with another one. You have to do tricks where you have a symlink to the real directory and atomically replace the symlink with a new symlink to the new directory. Another comment pointed out though that most of the time you only need to update the cert, and not the key. So it's mostly a moot issue..