diff --git a/common/coap-server/src/main/java/org/thingsboard/server/coapserver/DefaultCoapServerService.java b/common/coap-server/src/main/java/org/thingsboard/server/coapserver/DefaultCoapServerService.java
index 087f8137c7..03de8b7b91 100644
--- a/common/coap-server/src/main/java/org/thingsboard/server/coapserver/DefaultCoapServerService.java
+++ b/common/coap-server/src/main/java/org/thingsboard/server/coapserver/DefaultCoapServerService.java
@@ -154,6 +154,7 @@ public class DefaultCoapServerService implements CoapServerService, SmartInitial
         return networkConfig;
     }
 
+    // Note: this method has a side effect — it sets COAP_SECURE_PORT on the provided networkConfig.
     private DtlsConnectorConfig buildDtlsConnectorConfig(Configuration networkConfig) throws UnknownHostException {
         TbCoapDtlsSettings dtlsSettings = coapServerContext.getDtlsSettings();
         DtlsConnectorConfig dtlsConnectorConfig = dtlsSettings.dtlsConnectorConfig(networkConfig);
@@ -195,7 +196,9 @@ public class DefaultCoapServerService implements CoapServerService, SmartInitial
         DTLSConnector newConnector = createDtlsConnector(dtlsConnectorConfig);
         CoapEndpoint newEndpoint = buildDtlsEndpoint(networkConfig, newConnector);
 
-        // Stop the old endpoint first to release the port before starting the new one
+        // Californium binds the DTLS port at connector construction time, so we must stop the old
+        // endpoint first to release the port. This creates a brief window where the port is unbound;
+        // if the new endpoint fails to start, we attempt to restore the old one (see rollback below).
         if (oldDtlsEndpoint != null) {
             log.info("Stopping old DTLS endpoint to release the port...");
             server.getEndpoints().remove(oldDtlsEndpoint);
diff --git a/common/transport/transport-api/src/main/java/org/thingsboard/server/common/transport/config/ssl/KeystoreSslCredentials.java b/common/transport/transport-api/src/main/java/org/thingsboard/server/common/transport/config/ssl/KeystoreSslCredentials.java
index 7a2fb1a545..7cbc4403b7 100644
--- a/common/transport/transport-api/src/main/java/org/thingsboard/server/common/transport/config/ssl/KeystoreSslCredentials.java
+++ b/common/transport/transport-api/src/main/java/org/thingsboard/server/common/transport/config/ssl/KeystoreSslCredentials.java
@@ -20,9 +20,9 @@ import lombok.EqualsAndHashCode;
 import org.thingsboard.server.common.data.ResourceUtils;
 import org.thingsboard.server.common.data.StringUtils;
 
-import java.io.File;
 import java.io.IOException;
 import java.io.InputStream;
+import java.nio.file.Files;
 import java.nio.file.Path;
 import java.security.GeneralSecurityException;
 import java.security.KeyStore;
@@ -62,9 +62,9 @@ public class KeystoreSslCredentials extends AbstractSslCredentials {
     @Override
     public List<Path> getCertificateFilePaths() {
         if (!StringUtils.isEmpty(storeFile) && !storeFile.startsWith(ResourceUtils.CLASSPATH_URL_PREFIX)) {
-            File storeFileObj = new File(storeFile);
-            if (storeFileObj.exists()) {
-                return Collections.singletonList(storeFileObj.toPath().toAbsolutePath());
+            Path resolved = Path.of(storeFile).toAbsolutePath();
+            if (Files.exists(resolved)) {
+                return Collections.singletonList(resolved);
             }
         }
         return Collections.emptyList();
diff --git a/common/transport/transport-api/src/main/java/org/thingsboard/server/common/transport/config/ssl/PemSslCredentials.java b/common/transport/transport-api/src/main/java/org/thingsboard/server/common/transport/config/ssl/PemSslCredentials.java
index 72ad7af9c5..c6eb75698e 100644
--- a/common/transport/transport-api/src/main/java/org/thingsboard/server/common/transport/config/ssl/PemSslCredentials.java
+++ b/common/transport/transport-api/src/main/java/org/thingsboard/server/common/transport/config/ssl/PemSslCredentials.java
@@ -30,10 +30,10 @@ import org.bouncycastle.openssl.jcajce.JcePEMDecryptorProviderBuilder;
 import org.thingsboard.server.common.data.ResourceUtils;
 import org.thingsboard.server.common.data.StringUtils;
 
-import java.io.File;
 import java.io.IOException;
 import java.io.InputStream;
 import java.io.InputStreamReader;
+import java.nio.file.Files;
 import java.nio.file.Path;
 import java.security.GeneralSecurityException;
 import java.security.KeyStore;
@@ -145,22 +145,18 @@ public class PemSslCredentials extends AbstractSslCredentials {
     @Override
     public List<Path> getCertificateFilePaths() {
         List<Path> paths = new ArrayList<>();
+        addIfFileSystemPath(paths, certFile);
+        addIfFileSystemPath(paths, keyFile);
+        return paths;
+    }
 
-        if (!StringUtils.isEmpty(certFile) && !certFile.startsWith(ResourceUtils.CLASSPATH_URL_PREFIX)) {
-            File certFileObj = new File(certFile);
-            if (certFileObj.exists()) {
-                paths.add(certFileObj.toPath().toAbsolutePath());
-            }
-        }
-
-        if (!StringUtils.isEmpty(keyFile) && !keyFile.startsWith(ResourceUtils.CLASSPATH_URL_PREFIX)) {
-            File keyFileObj = new File(keyFile);
-            if (keyFileObj.exists()) {
-                paths.add(keyFileObj.toPath().toAbsolutePath());
+    private static void addIfFileSystemPath(List<Path> paths, String filePath) {
+        if (!StringUtils.isEmpty(filePath) && !filePath.startsWith(ResourceUtils.CLASSPATH_URL_PREFIX)) {
+            Path resolved = Path.of(filePath).toAbsolutePath();
+            if (Files.exists(resolved)) {
+                paths.add(resolved);
             }
         }
-
-        return paths;
     }
 
 }
diff --git a/common/transport/transport-api/src/main/java/org/thingsboard/server/common/transport/service/CertificateReloadManager.java b/common/transport/transport-api/src/main/java/org/thingsboard/server/common/transport/service/CertificateReloadManager.java
index f243c64c50..eec84a22f0 100644
--- a/common/transport/transport-api/src/main/java/org/thingsboard/server/common/transport/service/CertificateReloadManager.java
+++ b/common/transport/transport-api/src/main/java/org/thingsboard/server/common/transport/service/CertificateReloadManager.java
@@ -247,6 +247,8 @@ public class CertificateReloadManager implements SmartInitializingSingleton, Dis
             } catch (Exception e) {
                 consecutiveFailures++;
                 failedCombinedChecksum = combinedChecksum;
+                // Deliberately NOT updating the lastModifiedMap here, so the next poll cycle retries
+                // (mtime mismatch passes the early gate, checksum matches failedCombinedChecksum).
                 log.error("Failed to reload certificate for {} (attempt {}/{}): {}",
                         name, consecutiveFailures, MAX_CONSECUTIVE_FAILURES, e.getMessage(), e);
             }