From: Tom Lane <tgl@sss.pgh.pa.us>
To: John Scalia <jayknowsunix@gmail.com>
cc: pgsql-admin@postgresql.org
Subject: Re: SSL certificate revocation file will not load
In-reply-to: <68DC7C40-A815-4F80-924A-45C07A463D55@gmail.com>
References: 
 <CABzCKRCjpiosAEVujuvBN+KOzdaQSJyLuo-TTQdmc98PqcKjNA@mail.gmail.com>
 <23871.1497473425@sss.pgh.pa.us>
 <68DC7C40-A815-4F80-924A-45C07A463D55@gmail.com>
Comments: In-reply-to John Scalia <jayknowsunix@gmail.com>
	message dated "Wed, 14 Jun 2017 17:55:22 -0400"
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <26526.1497478022.1@sss.pgh.pa.us>
Date: Wed, 14 Jun 2017 18:07:02 -0400
Message-ID: <26527.1497478022@sss.pgh.pa.us>
Precedence: bulk
Sender: pgsql-admin-owner@postgresql.org

John Scalia <jayknowsunix@gmail.com> writes:
> Well, it turned out that the CRL was in the wrong format. So, I managed
> to convert it with OpenSSL and it loaded properly. I do have one more
> question... the Treasury Department, which produces these certificates
> for us, expires all the CRL's in just 6 hours,

Ugh.

> so does that mean I'd have to do restart on the database each time I got
> a new one or would a reload work?

As of PG 10, a reload would work, but in prior versions you'll have to
restart to get it to pick up new SSL config files.

If you're feeling desperate you could try back-patching commit de41869b6,
but keep in mind that hasn't made it through a beta-test cycle yet.

			regards, tom lane


-- 
Sent via pgsql-admin mailing list (pgsql-admin@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-admin