MIME-Version: 1.0
References: 
 <CAHtZvrfap1R6+D=KsfE1iPU6_reGaPyf=m_GryEUNrNWe0KYbg@mail.gmail.com>
 <20260331.184832.554536681926821839.ishii@postgresql.org>
 <CAHtZvrcEFdHnOERL6s6GmEAYe3wcNMjfY0FvT9QYcwgUquOmpw@mail.gmail.com>
 <20260401.180542.2251969369195681939.ishii@postgresql.org>
 <CAHtZvrfTR=1vbry_HBg5rmWgO1O22ryjqt9tvNd5oT7NjX-vEA@mail.gmail.com>
In-Reply-To: 
 <CAHtZvrfTR=1vbry_HBg5rmWgO1O22ryjqt9tvNd5oT7NjX-vEA@mail.gmail.com>
From: Bob Ross <bob.ross.19821@gmail.com>
Date: Mon, 13 Apr 2026 09:28:40 +0200
Message-ID: 
 <CAHtZvrcnFHgLatJQrsGH0-Tupb4vY+dZ3jiBcK5uRgJ1AbGEAg@mail.gmail.com>
Subject: Re: Rotate SSL certificates on reload (SIGHUP) without restart
To: Tatsuo Ishii <ishii@postgresql.org>
Cc: "pgpool-hackers@lists.postgresql.org"
 <pgpool-hackers@lists.postgresql.org>
Content-Type: multipart/alternative; boundary="0000000000004361f3064f526f0b"
Archived-At: 
 <https://www.postgresql.org/message-id/CAHtZvrcnFHgLatJQrsGH0-Tupb4vY%2BdZ3jiBcK5uRgJ1AbGEAg%40mail.gmail.com>
Precedence: bulk

--0000000000004361f3064f526f0b
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Hi Tatsuo,

Please let me know if you need any assistance with updating your test
cases. I am be happy to help.

Thanks,
Bob


On Thu, Apr 2, 2026 at 9:57=E2=80=AFPM Bob Ross <bob.ross.19821@gmail.com> =
wrote:

> Hi Tatsuo,
>
> Thanks for putting together the regression tests.
>
> Thoughts on your questions:
> - CA Certificates - Yes, adding a cert auth test is highly recommended. W=
e
> could test this by generating two different dummy CA certificates. Start
> pgpool trusting CA #1, swap the config to CA #2, reload and verify if
> client connection correctly gets rejected.
> - DH parameters - perhaps we can test this by providing a non-existent
> file path and then use grep to check pgpool.log for specific warning
> message (per pool_ssl.c it=E2=80=99s =E2=80=9CDH: could not load DH param=
eters=E2=80=9D) when
> pgpool tries to load the file.
>
> Regards,
> Bob
>
>
> On Wednesday, April 1, 2026, Tatsuo Ishii <ishii@postgresql.org> wrote:
>
>> Hi Bob,
>>
>> > Hi Tatsuo,
>> >
>> > Thanks for double-checking! Please feel free to go ahead and write the
>> > regression tests if you're up for it. I'd really appreciate the help.
>>
>> I have written the first version of the regression test. This test
>> performs:
>>
>> 1. Set bad value (fixed string "bad_value") to a config param and
>>    restart pgpool so that SSL connection does not establish between
>>    client and pgpool.
>>
>> 2. Set good value to the config and reload pgpool so that SSL
>>    connection establishes.
>>
>> The test is run against:
>> ssl_cert
>> ssl_ciphers
>> ssl_crl_file
>> ssl_ecdh_curve
>> ssl_key
>>
>> It does not test ssl_ca_cert and ssl_ca_cert_dir because the test is
>> based on 023.ssl_connection which does not check cert auth. Should we
>> test cert auth as well?
>>
>> Also this does not test followings:
>>
>> - ssl_dh_params_file
>> If bad value is set to the parameter, it falls back to a builtin
>> value. So it is not possible to set a bad value to the parameter.
>> Do you have an idea to test this?
>>
>> - ssl_passphrase_command
>> Our cert does not require pass passphrase.
>>
>> - ssl_prefer_server_ciphers
>> This only affects server side (backend) ciphers. The test only tests
>> SSL connection between client and pgpool.
>>
>> Attached is the v1 patch including your patch (I have remove "-----"
>> from your commit message. Otherwise the commit message cuts in the
>> middle)  and the test script.
>> What do you think?
>>
>> Regards,
>> --
>> Tatsuo Ishii
>> SRA OSS K.K.
>> English: http://www.sraoss.co.jp/index_en/
>> Japanese:http://www.sraoss.co.jp
>>
>

--0000000000004361f3064f526f0b
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">Hi Tatsuo,<div><br></div><div>Please let me know if you ne=
ed any assistance with updating your test cases. I am be happy to help.</di=
v><div><br></div><div>Thanks,</div><div>Bob</div><div><br></div></div><br><=
div class=3D"gmail_quote gmail_quote_container"><div dir=3D"ltr" class=3D"g=
mail_attr">On Thu, Apr 2, 2026 at 9:57=E2=80=AFPM Bob Ross &lt;<a href=3D"m=
ailto:bob.ross.19821@gmail.com">bob.ross.19821@gmail.com</a>&gt; wrote:<br>=
</div><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;b=
order-left:1px solid rgb(204,204,204);padding-left:1ex">Hi Tatsuo,=C2=A0<di=
v><br></div><div>Thanks for putting together the regression tests.=C2=A0</d=
iv><div><br></div><div>Thoughts on your questions:=C2=A0</div><div>- CA Cer=
tificates - Yes, adding a cert auth test is highly recommended. We could te=
st this by generating two different dummy CA certificates. Start pgpool tru=
sting CA #1, swap the config to CA #2, reload and verify if client connecti=
on correctly gets rejected.=C2=A0</div><div>- DH parameters - perhaps we ca=
n test this by providing a non-existent file path and then use grep to chec=
k pgpool.log for specific warning message (per pool_ssl.c it=E2=80=99s =E2=
=80=9CDH: could not load DH parameters=E2=80=9D) when pgpool tries to load =
the file.=C2=A0</div><div><br></div><div>Regards,</div><div>Bob</div><div><=
br></div><div><br></div><div>On Wednesday, April 1, 2026, Tatsuo Ishii &lt;=
<a href=3D"mailto:ishii@postgresql.org" target=3D"_blank">ishii@postgresql.=
org</a>&gt; wrote:<br><blockquote class=3D"gmail_quote" style=3D"margin:0px=
 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Hi =
Bob,<br>
<br>
&gt; Hi Tatsuo,<br>
&gt; <br>
&gt; Thanks for double-checking! Please feel free to go ahead and write the=
<br>
&gt; regression tests if you&#39;re up for it. I&#39;d really appreciate th=
e help.<br>
<br>
I have written the first version of the regression test. This test<br>
performs:<br>
<br>
1. Set bad value (fixed string &quot;bad_value&quot;) to a config param and=
<br>
=C2=A0 =C2=A0restart pgpool so that SSL connection does not establish betwe=
en<br>
=C2=A0 =C2=A0client and pgpool.<br>
<br>
2. Set good value to the config and reload pgpool so that SSL<br>
=C2=A0 =C2=A0connection establishes.<br>
<br>
The test is run against:<br>
ssl_cert<br>
ssl_ciphers<br>
ssl_crl_file<br>
ssl_ecdh_curve<br>
ssl_key<br>
<br>
It does not test ssl_ca_cert and ssl_ca_cert_dir because the test is<br>
based on 023.ssl_connection which does not check cert auth. Should we<br>
test cert auth as well?<br>
<br>
Also this does not test followings:<br>
<br>
- ssl_dh_params_file<br>
If bad value is set to the parameter, it falls back to a builtin<br>
value. So it is not possible to set a bad value to the parameter.<br>
Do you have an idea to test this?<br>
<br>
- ssl_passphrase_command<br>
Our cert does not require pass passphrase.<br>
<br>
- ssl_prefer_server_ciphers<br>
This only affects server side (backend) ciphers. The test only tests<br>
SSL connection between client and pgpool.<br>
<br>
Attached is the v1 patch including your patch (I have remove &quot;-----&qu=
ot;<br>
from your commit message. Otherwise the commit message cuts in the<br>
middle)=C2=A0 and the test script.<br>
What do you think?<br>
<br>
Regards,<br>
--<br>
Tatsuo Ishii<br>
SRA OSS K.K.<br>
English: <a href=3D"http://www.sraoss.co.jp/index_en/" target=3D"_blank">ht=
tp://www.sraoss.co.jp/index_en/</a><br>
Japanese:<a href=3D"http://www.sraoss.co.jp" target=3D"_blank">http://www.s=
raoss.co.jp</a><br>
</blockquote></div>
</blockquote></div>

--0000000000004361f3064f526f0b--