From: Peter Eisentraut <peter.eisentraut@2ndquadrant.com>
To: Joe Conway <mail@joeconway.com>
To: pgsql-docs <pgsql-docs@postgreSQL.org>
Subject: Re: Passphrase protected SSL key and reloads
Date: Wed, 24 Apr 2019 20:58:27 +0200
Message-ID: <013a21e7-75aa-2a68-1747-d13fa6246625@2ndquadrant.com> (raw)
In-Reply-To: <cdecbf67-54c6-2522-2d77-abffc3209d23@joeconway.com>
References: <75731d49-ad04-49b0-7bf7-09c0d89c9473@joeconway.com>
<cdecbf67-54c6-2522-2d77-abffc3209d23@joeconway.com>
On 2019-04-24 13:22, Joe Conway wrote:
>> "Using a passphrase also disables the ability to change the server's
>> SSL configuration without a server restart."
>>
>> But as of pg11 we have ssl_passphrase_command_supports_reload, which as
>> I understand it should allow this if the passphrase command is not
>> interactive. Per
>> https://www.postgresql.org/docs/11/runtime-config-connection.html#GUC-SSL-PASSPHRASE-COMMAND-SUPPORT...
>>
>> "Setting this parameter to true might be appropriate if the passphrase
>> is obtained from a file, for example."
>>
>> Am I misunderstanding, or was the former quote missed when updating the
>> docs for pg11?
Right, that should be amended. I suspect the next sentence
Furthermore, passphrase-protected private keys cannot be used at all
on Windows.
is also related to this. Can someone comment on this?
--
Peter Eisentraut http://www.2ndQuadrant.com/
PostgreSQL Development, 24x7 Support, Remote DBA, Training & Services
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-docs@postgresql.org
Cc: peter.eisentraut@2ndquadrant.com, mail@joeconway.com
Subject: Re: Passphrase protected SSL key and reloads
In-Reply-To: <013a21e7-75aa-2a68-1747-d13fa6246625@2ndquadrant.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox