Docker Daemon needs to be able to reload its own certificates without a restart

Description

Description:

https://github.com/moby/moby/issues/39869 clone but for the tlsverify side of the certificates

We are using mutual-TLS with short lived certificates

{
// other infos
  "tls": true,
  "tlscert": "/etc/ssl/certs/docker-daemon.crt",
  "tlskey": "/etc/ssl/private/docker-daemon.key",
  "tlsverify": true
}

If the cerificate gets reloaded you get

Docker event stream error: error during connect: Get "endpoint:2376/v1.50/events?filters=%7B%22type%22%3A%7B%22container%22%3Atrue%2C%22network%22%3Atrue%7D%7D": tls: failed to verify certificate: x509: certificate has expired or is not yet valid: current time 2025-06-16T13:10:03Z is after 2025-06-14T07:01:54Z

systemctl reload docker doesn't do anything

With the CA/B forum having voted to reduce the maximum recognized certificate validity time to 47 days from 2029 (https://groups.google.com/a/groups.cabforum.org/g/servercert-wg/c/9768xgUUfhQ?pli=1, yes it is for the browsers but I expect it to carry over outside of the browsers) it will start to become harder to maintain a mTLS-enabled Docker instance without ability to hot-reload the daemon.

Start with the daemon reload behavior represented by systemctl reload docker and the TLS certificate and key paths shown in the issue. Determine how mutual-TLS certificates are reloaded without restarting the daemon, then verify that renewed certificates are accepted for tlsverify connections and event streams.