Date: Thu, 19 Mar 2026 19:22:25 +0900 (JST)
Message-Id: <20260319.192225.349123033503761335.ishii@postgresql.org>
To: bob.ross.19821@gmail.com
Cc: pgpool-hackers@lists.postgresql.org
Subject: Re: Rotate SSL certificates on reload (SIGHUP) without restart
From: Tatsuo Ishii <ishii@postgresql.org>
In-Reply-To: 
 <CAHtZvrdYG5ebRkZF+tZOqOEZ4WMjMjAC8efiKBRKQua2JHpJ9g@mail.gmail.com>
References: 
 <CAHtZvrddqfbnERYY_DqgURWCjuXeTjM0y08k-ZP_B0bAHYx2ag@mail.gmail.com>
	<20251024.134447.1860326874693905337.ishii@postgresql.org>
	<CAHtZvrdYG5ebRkZF+tZOqOEZ4WMjMjAC8efiKBRKQua2JHpJ9g@mail.gmail.com>
Mime-Version: 1.0
Content-Type: Text/Plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Archived-At: 
 <https://www.postgresql.org/message-id/20260319.192225.349123033503761335.ishii%40postgresql.org>
Precedence: bulk

Hi Bob,

> Hi Tatsuo,
> 
> Have there been any further considerations regarding changes to the pgPool
> codebase to support SSL certificate rotation on reload?
> 
> As DigiCert has announced last year (
> https://www.digicert.com/blog/tls-certificate-lifetimes-will-officially-reduce-to-47-days),
> TLS/SSL certificate lifetimes will be reduced progressively in the coming
> years, with the industry moving toward much shorter validity periods. This
> makes the current requirement to fully restart the service for certificate
> renewal increasingly impractical.
> 
> Please let us know whether this enhancement is being considered, or if
> there are any plans or timelines for addressing it.

I just have too many things to do for now (fixing bugs and evaluating
proposed patches), and I cannot estimate timelines for this. Plus, I
am not super familiar with this are (SSL). If you could provide
patches for this, it would greatly help me.

Best regards,
--
Tatsuo Ishii
SRA OSS K.K.
English: http://www.sraoss.co.jp/index_en/
Japanese:http://www.sraoss.co.jp