@@ -441,7 +441,9 @@ Sources define database connections. Each source represents a database that DBHu
 <ParamField path="sslkey" type="string">
   Path to the PEM private key for `sslcert`. The key must be **unencrypted** (an encrypted key is rejected at startup; `sslpassword` is not supported). DER-encoded keys are not accepted.
 
-  Keep the key file private (`chmod 0600`); DBHub reads it once at startup and never logs its contents.
+  Keep the key file private (`chmod 0600`); DBHub never logs its contents.
+
+  Both files are read at startup (a missing file or an encrypted key fails startup) and then re-read each time a new connection is opened, matching libpq. Short-lived client certificates that are reissued on a timer are picked up without a restart: replace the files in place (an atomic rename is safest) and the next connection presents the new pair. If a file cannot be read when a connection is opened, that connection fails with an error naming the file, and the next one retries. The same applies to `sslrootcert`.
 
   Supports `~/` path expansion.
 
 
@@ -2,6 +2,7 @@ import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
 import fs from 'fs';
 import os from 'os';
 import path from 'path';
+import pg from 'pg';
 import { PostgresConnector } from '../postgres/index.js';
 import { MySQLConnector } from '../mysql/index.js';
 import { MariaDBConnector } from '../mariadb/index.js';
@@ -221,6 +222,120 @@ describe('DSN Parser - PostgreSQL client certificate (sslcert/sslkey)', () => {
   });
 });
 
+describe('DSN Parser - PostgreSQL certificate rotation (sslrootcert/sslcert/sslkey)', () => {
+  const parser = new PostgresConnector().dsnParser;
+  let tempDir: string;
+  let caPath: string;
+  let certPath: string;
+  let keyPath: string;
+  const CA = '-----BEGIN CERTIFICATE-----\nca\n-----END CERTIFICATE-----\n';
+  const CERT = '-----BEGIN CERTIFICATE-----\nclient\n-----END CERTIFICATE-----\n';
+  const KEY = '-----BEGIN PRIVATE KEY-----\nclient\n-----END PRIVATE KEY-----\n';
+  const NEW_CA = '-----BEGIN CERTIFICATE-----\nca-rotated\n-----END CERTIFICATE-----\n';
+  const NEW_CERT = '-----BEGIN CERTIFICATE-----\nclient-rotated\n-----END CERTIFICATE-----\n';
+  const NEW_KEY = '-----BEGIN PRIVATE KEY-----\nclient-rotated\n-----END PRIVATE KEY-----\n';
+  const ENCRYPTED_KEY =
+    '-----BEGIN ENCRYPTED PRIVATE KEY-----\nx\n-----END ENCRYPTED PRIVATE KEY-----\n';
+
+  const dsn = () =>
+    'postgres://user:pass@localhost:5432/db?sslmode=verify-full' +
+    `&sslrootcert=${encodeURIComponent(caPath)}` +
+    `&sslcert=${encodeURIComponent(certPath)}&sslkey=${encodeURIComponent(keyPath)}`;
+
+  type ClientCtor = new (config: pg.PoolConfig) => pg.Client;
+  /** The pool constructs one client per physical connection from config.Client. */
+  const newPoolClient = (config: pg.PoolConfig): pg.Client =>
+    new (config.Client as unknown as ClientCtor)(config);
+  const pems = (config: pg.PoolConfig) => {
+    const ssl = config.ssl as { ca?: string; cert?: string; key?: string };
+    return { ca: ssl.ca, cert: ssl.cert, key: ssl.key };
+  };
+
+  beforeEach(() => {
+    tempDir = fs.mkdtempSync(path.join(os.tmpdir(), 'dbhub-certrotation-test-'));
+    caPath = writeTempPem(tempDir, 'ca.pem', CA);
+    certPath = writeTempPem(tempDir, 'client.crt', CERT);
+    keyPath = writeTempPem(tempDir, 'client.key', KEY);
+    // Stop at the point where pg would open a socket; the PEM reload happens before it.
+    vi.spyOn(pg.Client.prototype, 'connect').mockImplementation(function (
+      this: pg.Client,
+      callback?: (err: Error) => void
+    ) {
+      if (callback) {
+        callback(undefined as unknown as Error);
+        return;
+      }
+      return Promise.resolve();
+    } as typeof pg.Client.prototype.connect);
+  });
+
+  afterEach(() => {
+    vi.restoreAllMocks();
+    fs.rmSync(tempDir, { recursive: true, force: true });
+  });
+
+  it('installs a custom pool Client only when PEM files are configured', async () => {
+    const withPems = await parser.parse(dsn());
+    expect(withPems.Client).toBeDefined();
+    const withoutPems = await parser.parse('postgres://user:pass@localhost:5432/db?sslmode=require');
+    expect(withoutPems.Client).toBeUndefined();
+  });
+
+  it('re-reads rotated PEM files when a new connection is opened', async () => {
+    const config = await parser.parse(dsn());
+    expect(config.ssl).toEqual({ rejectUnauthorized: true, ca: CA, cert: CERT, key: KEY });
+
+    fs.writeFileSync(caPath, NEW_CA);
+    fs.writeFileSync(certPath, NEW_CERT);
+    fs.writeFileSync(keyPath, NEW_KEY);
+
+    await newPoolClient(config).connect();
+    // pg marks ssl.key non-enumerable when a Client is constructed, so
+    // compare the fields explicitly rather than with toEqual.
+    expect(pems(config)).toEqual({ ca: NEW_CA, cert: NEW_CERT, key: NEW_KEY });
+    expect(pg.Client.prototype.connect).toHaveBeenCalledTimes(1);
+  });
+
+  it('fails the new connection, naming the file, when a PEM file cannot be read', async () => {
+    const config = await parser.parse(dsn());
+    fs.rmSync(keyPath);
+
+    const err = await newPoolClient(config).connect().catch((e: unknown) => e as Error);
+    expect((err as Error).name).toBe('FailedToReadCertificate');
+    expect((err as Error).message).toContain(`Failed to read SSL client key at '${keyPath}'`);
+    expect(pg.Client.prototype.connect).not.toHaveBeenCalled();
+  });
+
+  it('reports the failure through the callback form of connect as well', async () => {
+    const config = await parser.parse(dsn());
+    fs.rmSync(certPath);
+
+    const err = await new Promise<Error>((resolve) => newPoolClient(config).connect(resolve));
+    expect(err.message).toContain(`Failed to read SSL client certificate at '${certPath}'`);
+    expect(pg.Client.prototype.connect).not.toHaveBeenCalled();
+  });
+
+  it('never publishes a half-rotated cert/key pair', async () => {
+    const config = await parser.parse(dsn());
+    fs.writeFileSync(certPath, NEW_CERT);
+    fs.rmSync(keyPath);
+
+    await expect(newPoolClient(config).connect()).rejects.toThrow('Failed to read SSL client key');
+    // The pair in the pool config is still the one that was read together.
+    expect(pems(config)).toEqual({ ca: CA, cert: CERT, key: KEY });
+  });
+
+  it('rejects a rotated key that is encrypted', async () => {
+    const config = await parser.parse(dsn());
+    fs.writeFileSync(keyPath, ENCRYPTED_KEY);
+
+    await expect(newPoolClient(config).connect()).rejects.toThrow(
+      'encrypted private keys are not supported'
+    );
+    expect(pg.Client.prototype.connect).not.toHaveBeenCalled();
+  });
+});
+
 describe('DSN Parser - PostgreSQL query timeout', () => {
   it('configures a server-side statement timeout before the client fallback', async () => {
     const parser = new PostgresConnector().dsnParser;
 
@@ -38,7 +38,9 @@ function generateCerts(dir: string): void {
     'req', '-x509', '-newkey', 'rsa:2048', '-nodes', '-days', '1',
     '-subj', '/CN=dbhub-test-ca', '-keyout', 'ca.key', '-out', 'ca.crt',
   ]);
-  for (const [name, cn] of [['server', 'localhost'], ['client', DB_USER]]) {
+  // client and client-rotated share a CN so both authenticate as DB_USER; they
+  // differ by serial number, which is how the rotation test tells them apart.
+  for (const [name, cn] of [['server', 'localhost'], ['client', DB_USER], ['client-rotated', DB_USER]]) {
     openssl([
       'req', '-newkey', 'rsa:2048', '-nodes', '-subj', `/CN=${cn}`,
       '-keyout', `${name}.key`, '-out', `${name}.csr`,
@@ -143,6 +145,76 @@ describe.skipIf(!hasOpenssl())('PostgreSQL client certificate authentication', (
     }
   });
 
+  /** Decimal serial of a generated certificate, as pg_stat_ssl.client_serial reports it. */
+  const serialOf = (name: string): string => {
+    const out = execFileSync('openssl', ['x509', '-noout', '-serial', '-in', path.join(certDir, `${name}.crt`)])
+      .toString()
+      .trim();
+    return BigInt(`0x${out.split('=')[1]}`).toString();
+  };
+
+  /** Copy a generated client cert/key pair over the files the DSN points at. */
+  const installClientPair = (dir: string, name: string): void => {
+    fs.copyFileSync(path.join(certDir, `${name}.crt`), path.join(dir, 'client.crt'));
+    fs.copyFileSync(path.join(certDir, `${name}.key`), path.join(dir, 'client.key'));
+  };
+
+  const SERIAL_SQL =
+    'SELECT pg_sleep(0.5), client_serial::text AS serial FROM pg_stat_ssl WHERE pid = pg_backend_pid()';
+
+  it('should present a client certificate rotated on disk to new pool connections', async () => {
+    const rotatingDir = fs.mkdtempSync(path.join(certDir, 'rotating-'));
+    installClientPair(rotatingDir, 'client');
+    const dsn =
+      `${baseUri}?sslmode=verify-ca&sslrootcert=${encodeURIComponent(path.join(certDir, 'ca.crt'))}` +
+      `&sslcert=${encodeURIComponent(path.join(rotatingDir, 'client.crt'))}` +
+      `&sslkey=${encodeURIComponent(path.join(rotatingDir, 'client.key'))}`;
+    const connector = new PostgresConnector();
+    try {
+      await connector.connect(dsn);
+      const before = await connector.executeSQL(SERIAL_SQL, {});
+      expect(before.resultSets[0].rows[0].serial).toBe(serialOf('client'));
+
+      installClientPair(rotatingDir, 'client-rotated');
+
+      // Two overlapping queries: one reuses the idle connection, the other
+      // forces the pool to open a new one, which must present the new pair.
+      const results = await Promise.all([
+        connector.executeSQL(SERIAL_SQL, {}),
+        connector.executeSQL(SERIAL_SQL, {}),
+      ]);
+      const serials = results.map((r) => String(r.resultSets[0].rows[0].serial)).sort();
+      expect(serials).toEqual([serialOf('client'), serialOf('client-rotated')].sort());
+    } finally {
+      await connector.disconnect();
+    }
+  });
+
+  it('should fail new pool connections, naming the file, when a rotated key is missing', async () => {
+    const rotatingDir = fs.mkdtempSync(path.join(certDir, 'rotating-'));
+    installClientPair(rotatingDir, 'client');
+    const keyPath = path.join(rotatingDir, 'client.key');
+    const dsn =
+      `${baseUri}?sslmode=require&sslcert=${encodeURIComponent(path.join(rotatingDir, 'client.crt'))}` +
+      `&sslkey=${encodeURIComponent(keyPath)}`;
+    const connector = new PostgresConnector();
+    try {
+      await connector.connect(dsn);
+      fs.rmSync(keyPath);
+
+      const outcomes = await Promise.allSettled([
+        connector.executeSQL(SERIAL_SQL, {}),
+        connector.executeSQL(SERIAL_SQL, {}),
+      ]);
+      // The existing connection keeps working; only the new one fails.
+      expect(outcomes.filter((o) => o.status === 'fulfilled')).toHaveLength(1);
+      const rejected = outcomes.find((o) => o.status === 'rejected') as PromiseRejectedResult;
+      expect(rejected.reason.message).toContain(`Failed to read SSL client key at '${keyPath}'`);
+    } finally {
+      await connector.disconnect();
+    }
+  });
+
   it('should be rejected by the server without a client certificate', async () => {
     const connector = new PostgresConnector();
     try {