From: Bruce Momjian <bruce@momjian.us>
To: raf <raf@raf.org>
Cc: pgsql-admin@postgresql.org
Subject: Re: How to change the TLS certificate/key without restarting the server?
Date: Thu, 7 Nov 2019 19:16:10 -0500
Message-ID: <20191108001610.GA488@momjian.us> (raw)
In-Reply-To: <20191017052042.ombzxzwzo7xet47t@raf.org>
References: <20191017052042.ombzxzwzo7xet47t@raf.org>
On Thu, Oct 17, 2019 at 04:20:42PM +1100, raf wrote:
> Hi,
>
> https://www.postgresql.org/docs/12/ssl-tcp.html says:
>
> "Using a passphrase also disables the ability to
> change the server's SSL configuration without a
> server restart."
>
> How is key TLS key changed without a server restart?
> Is replacing the server.crt/server.key files enough
> or is there more to it?
>
> And will existing connections continue to use the old
> key until they disconnect?
The Postgres docs say:
https://www.postgresql.org/docs/12/ssl-tcp.html#SSL-SERVER-FILES
The server reads these files at server start and whenever the server
configuration is reloaded. On Windows systems, they are also re-read
whenever a new backend process is spawned for a new client connection.
I actually don't know if existing sessions start using the new
certificate, or just new sessions. This doc sentence suggests even
existing sessions use the new certificate:
If an error in these files is detected at server start, the server will
refuse to start. But if an error is detected during a configuration
reload, the files are ignored and the old SSL configuration continues to
be used.
--
Bruce Momjian <bruce@momjian.us> http://momjian.us
EnterpriseDB http://enterprisedb.com
+ As you are, so once was I. As I am, so you will be. +
+ Ancient Roman grave inscription +
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-admin@postgresql.org
Cc: bruce@momjian.us, raf@raf.org
Subject: Re: How to change the TLS certificate/key without restarting the server?
In-Reply-To: <20191108001610.GA488@momjian.us>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox