MIME-Version: 1.0
From: Bob Ross <bob.ross.19821@gmail.com>
Date: Thu, 23 Oct 2025 07:02:59 +0200
Message-ID: 
 <CAHtZvrddqfbnERYY_DqgURWCjuXeTjM0y08k-ZP_B0bAHYx2ag@mail.gmail.com>
Subject: Rotate SSL certificates on reload (SIGHUP) without restart
To: pgpool-hackers@lists.postgresql.org
Content-Type: multipart/alternative; boundary="00000000000089d33a0641cc59ca"
Archived-At: 
 <https://www.postgresql.org/message-id/CAHtZvrddqfbnERYY_DqgURWCjuXeTjM0y08k-ZP_B0bAHYx2ag%40mail.gmail.com>
Precedence: bulk

--00000000000089d33a0641cc59ca
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Hello,

Please consider adding support for rotating SSL certificates on reloading
pgpool2 (i.e., sending SIGHUP to the pgpool parent), so that certificate
rotations do not require a full service restart. PostgreSQL can pick up new
certificates on reload/SIGHUP; pgpool currently requires a restart, which
causes connection disruptions.

*Current behavior:*

   - Replace certificate/key files used by pgpool (e.g., server.crt,
   server.key, related CA chain).
   - Run systemctl reload pgpool2 (send SIGHUP to the pgpool parent).
   - Observations: Existing and new client connections continue to present
   the old certificate. Only systemctl restart pgpool2 applies the new cert=
s
   (causing connection interruptions).


*Expected behavior:*

   - After systemctl reload pgpool2 / SIGHUP, pgpool should re-read
   SSL-related configuration (server cert, private key, chain/CA, CRL if
   configured) and use them for new client connections, without requiring a
   full restart.
   - Existing connections can continue with the old context; only new
   handshakes should use the updated materials.
   - If reload fails, log a clear error and keep using the previous context
   to avoid breaking clients.
   - Consider parity with PostgreSQL=E2=80=99s SIGHUP behavior for certific=
ate
   reloads where feasible.


Regards,
Bob Ross

--00000000000089d33a0641cc59ca
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">Hello,<div><br></div><div>Please consider adding support f=
or rotating SSL certificates on reloading pgpool2 (i.e., sending SIGHUP to =
the pgpool parent), so that certificate rotations do not require a full ser=
vice restart. PostgreSQL can pick up new certificates on reload/SIGHUP; pgp=
ool currently requires a restart, which causes connection disruptions.<br><=
br><b>Current behavior:</b><br><ul><li>Replace certificate/key files used b=
y pgpool (e.g., server.crt, server.key, related CA chain).</li><li>Run syst=
emctl reload pgpool2 (send SIGHUP to the pgpool parent).</li><li>Observatio=
ns: Existing and new client connections continue to present the old certifi=
cate. Only systemctl restart pgpool2 applies the new certs (causing connect=
ion interruptions).</li></ul><b><br></b></div><div><b>Expected behavior:</b=
><br><ul><li>After systemctl reload pgpool2 / SIGHUP, pgpool should re-read=
 SSL-related configuration (server cert, private key, chain/CA, CRL if conf=
igured) and use them for new client connections, without requiring a full r=
estart.</li><li>Existing connections can continue with the old context; onl=
y new handshakes should use the updated materials.</li><li>If reload fails,=
 log a clear error and keep using the previous context to avoid breaking cl=
ients.</li><li>Consider parity with PostgreSQL=E2=80=99s SIGHUP behavior fo=
r certificate reloads where feasible.</li></ul></div><div><br></div><div>Re=
gards,</div><div>Bob Ross</div></div>

--00000000000089d33a0641cc59ca--