[Feature Request] SDKs users should have a way to inject new certificates to a connection instance

Go

Use the built-in Go TLS config GetClientCertificate callback.
(Is this obvious enough to users? Do we have a sample and some docs?)

TypeScript

In order to do this in the TypeScript client we'd need to recreate the client since it uses grpc.credentials.createSsl which don't support dynamic certs.

EDIT: This can be done via entire client replacement

Rust Core (used for the TypeScript worker)

TLS certs are statically provided to Core, we'd need a way to inject new certs.

EDIT: This can be done via entire client replacement

Per-SDK Tickets

• Go - Already supported sample: https://github.com/temporalio/samples-go/commit/065f2331fafbd9fd335c1d3dc8ebe635a71dace0
• Java - Already supported
• Core - Done via client replacement: https://github.com/temporalio/sdk-core/pull/721
• TypeScript - https://github.com/temporalio/sdk-typescript/issues/1412
• Python - https://github.com/temporalio/sdk-python/issues/513
• .NET - https://github.com/temporalio/sdk-dotnet/issues/235
• PHP - TODO
• Temporal CLI - N/A

Start with the per-SDK tickets and the TypeScript connection.ts entry point, then review the Go TLS GetClientCertificate callback and the Core TLS configuration described here. Determine the remaining TypeScript and PHP scope, including whether documentation or implementation is needed; done means the outstanding SDKs have a documented way to inject certificates dynamically.