When updating the SSL certificate, just update the file pointed to by tls_certificate_path: there is no need to restart synapse. (You may like to use a symbolic link to help make this process atomic.)

However, empirically this doesn't seem to be the case, and looking at the code it appears the file is only read on start up.