MIME-Version: 1.0
In-Reply-To: <20260401.180542.2251969369195681939.ishii@postgresql.org>
References: 
 <CAHtZvrfap1R6+D=KsfE1iPU6_reGaPyf=m_GryEUNrNWe0KYbg@mail.gmail.com>
 <20260331.184832.554536681926821839.ishii@postgresql.org>
 <CAHtZvrcEFdHnOERL6s6GmEAYe3wcNMjfY0FvT9QYcwgUquOmpw@mail.gmail.com>
 <20260401.180542.2251969369195681939.ishii@postgresql.org>
From: Bob Ross <bob.ross.19821@gmail.com>
Date: Thu, 2 Apr 2026 21:57:11 +0200
Message-ID: 
 <CAHtZvrfTR=1vbry_HBg5rmWgO1O22ryjqt9tvNd5oT7NjX-vEA@mail.gmail.com>
Subject: Rotate SSL certificates on reload (SIGHUP) without restart
To: Tatsuo Ishii <ishii@postgresql.org>
Cc: "pgpool-hackers@lists.postgresql.org"
 <pgpool-hackers@lists.postgresql.org>
Content-Type: multipart/alternative; boundary="00000000000050c38b064e7f9be3"
Archived-At: 
 <https://www.postgresql.org/message-id/CAHtZvrfTR%3D1vbry_HBg5rmWgO1O22ryjqt9tvNd5oT7NjX-vEA%40mail.gmail.com>
Precedence: bulk

--00000000000050c38b064e7f9be3
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Hi Tatsuo,

Thanks for putting together the regression tests.

Thoughts on your questions:
- CA Certificates - Yes, adding a cert auth test is highly recommended. We
could test this by generating two different dummy CA certificates. Start
pgpool trusting CA #1, swap the config to CA #2, reload and verify if
client connection correctly gets rejected.
- DH parameters - perhaps we can test this by providing a non-existent file
path and then use grep to check pgpool.log for specific warning message
(per pool_ssl.c it=E2=80=99s =E2=80=9CDH: could not load DH parameters=E2=
=80=9D) when pgpool tries
to load the file.

Regards,
Bob


On Wednesday, April 1, 2026, Tatsuo Ishii <ishii@postgresql.org> wrote:

> Hi Bob,
>
> > Hi Tatsuo,
> >
> > Thanks for double-checking! Please feel free to go ahead and write the
> > regression tests if you're up for it. I'd really appreciate the help.
>
> I have written the first version of the regression test. This test
> performs:
>
> 1. Set bad value (fixed string "bad_value") to a config param and
>    restart pgpool so that SSL connection does not establish between
>    client and pgpool.
>
> 2. Set good value to the config and reload pgpool so that SSL
>    connection establishes.
>
> The test is run against:
> ssl_cert
> ssl_ciphers
> ssl_crl_file
> ssl_ecdh_curve
> ssl_key
>
> It does not test ssl_ca_cert and ssl_ca_cert_dir because the test is
> based on 023.ssl_connection which does not check cert auth. Should we
> test cert auth as well?
>
> Also this does not test followings:
>
> - ssl_dh_params_file
> If bad value is set to the parameter, it falls back to a builtin
> value. So it is not possible to set a bad value to the parameter.
> Do you have an idea to test this?
>
> - ssl_passphrase_command
> Our cert does not require pass passphrase.
>
> - ssl_prefer_server_ciphers
> This only affects server side (backend) ciphers. The test only tests
> SSL connection between client and pgpool.
>
> Attached is the v1 patch including your patch (I have remove "-----"
> from your commit message. Otherwise the commit message cuts in the
> middle)  and the test script.
> What do you think?
>
> Regards,
> --
> Tatsuo Ishii
> SRA OSS K.K.
> English: http://www.sraoss.co.jp/index_en/
> Japanese:http://www.sraoss.co.jp
>

--00000000000050c38b064e7f9be3
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Hi Tatsuo,=C2=A0<div><br></div><div>Thanks for putting together the regress=
ion tests.=C2=A0</div><div><br></div><div>Thoughts on your questions:=C2=A0=
</div><div>- CA Certificates - Yes, adding a cert auth test is highly recom=
mended. We could test this by generating two different dummy CA certificate=
s. Start pgpool trusting CA #1, swap the config to CA #2, reload and verify=
 if client connection correctly gets rejected.=C2=A0</div><div>- DH paramet=
ers - perhaps we can test this by providing a non-existent file path and th=
en use grep to check pgpool.log for specific warning message (per pool_ssl.=
c it=E2=80=99s =E2=80=9CDH: could not load DH parameters=E2=80=9D) when pgp=
ool tries to load the file.=C2=A0</div><div><br></div><div>Regards,</div><d=
iv>Bob</div><div><br></div><div><br></div><div>On Wednesday, April 1, 2026,=
 Tatsuo Ishii &lt;<a href=3D"mailto:ishii@postgresql.org" target=3D"_blank"=
>ishii@postgresql.org</a>&gt; wrote:<br><blockquote class=3D"gmail_quote" s=
tyle=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hi B=
ob,<br>
<br>
&gt; Hi Tatsuo,<br>
&gt; <br>
&gt; Thanks for double-checking! Please feel free to go ahead and write the=
<br>
&gt; regression tests if you&#39;re up for it. I&#39;d really appreciate th=
e help.<br>
<br>
I have written the first version of the regression test. This test<br>
performs:<br>
<br>
1. Set bad value (fixed string &quot;bad_value&quot;) to a config param and=
<br>
=C2=A0 =C2=A0restart pgpool so that SSL connection does not establish betwe=
en<br>
=C2=A0 =C2=A0client and pgpool.<br>
<br>
2. Set good value to the config and reload pgpool so that SSL<br>
=C2=A0 =C2=A0connection establishes.<br>
<br>
The test is run against:<br>
ssl_cert<br>
ssl_ciphers<br>
ssl_crl_file<br>
ssl_ecdh_curve<br>
ssl_key<br>
<br>
It does not test ssl_ca_cert and ssl_ca_cert_dir because the test is<br>
based on 023.ssl_connection which does not check cert auth. Should we<br>
test cert auth as well?<br>
<br>
Also this does not test followings:<br>
<br>
- ssl_dh_params_file<br>
If bad value is set to the parameter, it falls back to a builtin<br>
value. So it is not possible to set a bad value to the parameter.<br>
Do you have an idea to test this?<br>
<br>
- ssl_passphrase_command<br>
Our cert does not require pass passphrase.<br>
<br>
- ssl_prefer_server_ciphers<br>
This only affects server side (backend) ciphers. The test only tests<br>
SSL connection between client and pgpool.<br>
<br>
Attached is the v1 patch including your patch (I have remove &quot;-----&qu=
ot;<br>
from your commit message. Otherwise the commit message cuts in the<br>
middle)=C2=A0 and the test script.<br>
What do you think?<br>
<br>
Regards,<br>
--<br>
Tatsuo Ishii<br>
SRA OSS K.K.<br>
English: <a href=3D"http://www.sraoss.co.jp/index_en/" target=3D"_blank">ht=
tp://www.sraoss.co.jp/index_<wbr>en/</a><br>
Japanese:<a href=3D"http://www.sraoss.co.jp" target=3D"_blank">http://www.s=
raoss.co.<wbr>jp</a><br>
</blockquote></div>

--00000000000050c38b064e7f9be3--