pg.ddx.io pgsql-admin@postgresql.org mailing list archive
help / color / mirror / Atom feedHow to change the TLS certificate/key without restarting the server?
3+ messages / 3 participants
[nested] [flat]
* How to change the TLS certificate/key without restarting the server?
@ 2019-10-17 05:20 raf <raf@raf.org>
0 siblings, 2 replies; 3+ messages in thread
From: raf @ 2019-10-17 05:20 UTC (permalink / raw)
To: pgsql-admin
Hi,
https://www.postgresql.org/docs/12/ssl-tcp.html says:
"Using a passphrase also disables the ability to
change the server's SSL configuration without a
server restart."
How is key TLS key changed without a server restart?
Is replacing the server.crt/server.key files enough
or is there more to it?
And will existing connections continue to use the old
key until they disconnect?
cheers,
raf
^ permalink raw reply [nested|flat] 3+ messages in thread
* Re: How to change the TLS certificate/key without restarting the server?
@ 2019-11-08 00:16 Bruce Momjian <bruce@momjian.us>
parent: raf <raf@raf.org>
1 sibling, 0 replies; 3+ messages in thread
From: Bruce Momjian @ 2019-11-08 00:16 UTC (permalink / raw)
To: raf <raf@raf.org>; +Cc: pgsql-admin
On Thu, Oct 17, 2019 at 04:20:42PM +1100, raf wrote:
> Hi,
>
> https://www.postgresql.org/docs/12/ssl-tcp.html says:
>
> "Using a passphrase also disables the ability to
> change the server's SSL configuration without a
> server restart."
>
> How is key TLS key changed without a server restart?
> Is replacing the server.crt/server.key files enough
> or is there more to it?
>
> And will existing connections continue to use the old
> key until they disconnect?
The Postgres docs say:
https://www.postgresql.org/docs/12/ssl-tcp.html#SSL-SERVER-FILES
The server reads these files at server start and whenever the server
configuration is reloaded. On Windows systems, they are also re-read
whenever a new backend process is spawned for a new client connection.
I actually don't know if existing sessions start using the new
certificate, or just new sessions. This doc sentence suggests even
existing sessions use the new certificate:
If an error in these files is detected at server start, the server will
refuse to start. But if an error is detected during a configuration
reload, the files are ignored and the old SSL configuration continues to
be used.
--
Bruce Momjian <bruce@momjian.us> http://momjian.us
EnterpriseDB http://enterprisedb.com
+ As you are, so once was I. As I am, so you will be. +
+ Ancient Roman grave inscription +
^ permalink raw reply [nested|flat] 3+ messages in thread
* Re: How to change the TLS certificate/key without restarting the server?
@ 2019-11-09 09:19 Peter Eisentraut <peter.eisentraut@2ndquadrant.com>
parent: raf <raf@raf.org>
1 sibling, 0 replies; 3+ messages in thread
From: Peter Eisentraut @ 2019-11-09 09:19 UTC (permalink / raw)
To: raf <raf@raf.org>; pgsql-admin
On 2019-10-17 07:20, raf wrote:
> https://www.postgresql.org/docs/12/ssl-tcp.html says:
>
> "Using a passphrase also disables the ability to
> change the server's SSL configuration without a
> server restart."
This is actually no longer true since PostgreSQL 11. I have committed a
fix.
> How is key TLS key changed without a server restart?
> Is replacing the server.crt/server.key files enough
> or is there more to it?
You need to issue a reload, for example using SIGHUP. That is supported
since PostgreSQL 10.
> And will existing connections continue to use the old
> key until they disconnect?
yes
--
Peter Eisentraut http://www.2ndQuadrant.com/
PostgreSQL Development, 24x7 Support, Remote DBA, Training & Services
^ permalink raw reply [nested|flat] 3+ messages in thread
end of thread, other threads:[~2019-11-09 09:19 UTC | newest]
Thread overview: 3+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2019-10-17 05:20 How to change the TLS certificate/key without restarting the server? raf <raf@raf.org>
2019-11-08 00:16 ` Bruce Momjian <bruce@momjian.us>
2019-11-09 09:19 ` Peter Eisentraut <peter.eisentraut@2ndquadrant.com>
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox