Support dynamic client certificate resolution (ResolvesClientCert)

CHANGELOG.md

@@ -20,6 +20,11 @@ to docs, or any other relevant information.
 ## [Unreleased]
 
 ### Added
+* Support for dynamic client certificate resolution via `TlsOptions::client_cert_resolver`, which
+  accepts an `Arc<dyn ResolvesClientCert>` for per-handshake mTLS certificate selection. This enables
+  transparent certificate rotation without process restarts — useful for short-lived certificates
+  managed by Vault, cert-manager, or HSM-backed signers. `ResolvesClientCert`, `CertifiedKey`, and
+  `SignatureScheme` are re-exported from the crate root for convenience.
 * `client()` and `workflow_handle()` helpers to `ActivityContext` for easily obtaining a Temporal client
 * Exposed `backoff_start_interval` when continuing as new, which will delay the first task of the
   continued workflow by the configured interval.

crates/client/Cargo.toml

@@ -46,6 +46,7 @@ tokio = { version = "1.47", default-features = false, features = [
 ] }
 tonic = { workspace = true, default-features = false, features = ["tls-native-roots", "channel", "gzip"] }
 tokio-rustls = { version = "0.26", default-features = false }
+rustls-native-certs = "0.8"
 tower = { version = "0.5", features = ["util"] }
 tracing = "0.1"
 url = "2.5"

crates/client/src/dns.rs

@@ -89,7 +89,18 @@ async fn build_endpoint(
             patched
         }
     });
-    let channel = add_tls_to_channel(tls_for_ip.as_ref().or(tls_options), channel).await?;
+    let tls_result = add_tls_to_channel(tls_for_ip.as_ref().or(tls_options), channel).await?;
+
+    let channel = match tls_result {
+        crate::TlsConfigResult::Standard(ep) => ep,
+        crate::TlsConfigResult::CustomConnector { .. } => {
+            return Err(ClientConnectError::InvalidConfig(
+                "client_cert_resolver is not yet supported with dns_load_balancing. \
+                 Disable dns_load_balancing or use static client_tls_options instead."
+                    .to_owned(),
+            ));
+        }
+    };
 
     let channel = if let Some(keep_alive) = keep_alive {
         channel

crates/client/src/envconfig.rs

@@ -90,6 +90,7 @@ fn build_tls_options(tls: ClientConfigTLS) -> Result<TlsOptions, ConfigError> {
         domain: tls.server_name,
         client_tls_options,
         server_cert_verifier: None,
+        client_cert_resolver: None,
     })
 }