pg.ddx.io pgsql-docs@postgresql.org mailing list archive
help / color / mirror / Atom feedRe: Passphrase protected SSL key and reloads
2+ messages / 2 participants
[nested] [flat]
* Re: Passphrase protected SSL key and reloads
@ 2019-04-24 11:22 Joe Conway <mail@joeconway.com>
0 siblings, 1 reply; 2+ messages in thread
From: Joe Conway @ 2019-04-24 11:22 UTC (permalink / raw)
To: pgsql-docs; Peter Eisentraut <peter_e@gmx.net>
(moved from Hackers to docs)
On 1/5/19 4:26 PM, Joe Conway wrote:
> On https://www.postgresql.org/docs/11/ssl-tcp.html it says:
>
> "Using a passphrase also disables the ability to change the server's
> SSL configuration without a server restart."
>
> But as of pg11 we have ssl_passphrase_command_supports_reload, which as
> I understand it should allow this if the passphrase command is not
> interactive. Per
> https://www.postgresql.org/docs/11/runtime-config-connection.html#GUC-SSL-PASSPHRASE-COMMAND-SUPPORT...
>
> "Setting this parameter to true might be appropriate if the passphrase
> is obtained from a file, for example."
>
> Am I misunderstanding, or was the former quote missed when updating the
> docs for pg11?
Since I am already thinking about pgsql-docs today -- any comment on this?
Joe
--
Crunchy Data - http://crunchydata.com
PostgreSQL Support for Secure Enterprises
Consulting, Training, & Open Source Development
Attachments:
signature.asc (application/pgp-signature, 832B) download
^ permalink raw reply [nested|flat] 2+ messages in thread
* Re: Passphrase protected SSL key and reloads
@ 2019-04-24 18:58 Peter Eisentraut <peter.eisentraut@2ndquadrant.com>
parent: Joe Conway <mail@joeconway.com>
0 siblings, 0 replies; 2+ messages in thread
From: Peter Eisentraut @ 2019-04-24 18:58 UTC (permalink / raw)
To: Joe Conway <mail@joeconway.com>; pgsql-docs
On 2019-04-24 13:22, Joe Conway wrote:
>> "Using a passphrase also disables the ability to change the server's
>> SSL configuration without a server restart."
>>
>> But as of pg11 we have ssl_passphrase_command_supports_reload, which as
>> I understand it should allow this if the passphrase command is not
>> interactive. Per
>> https://www.postgresql.org/docs/11/runtime-config-connection.html#GUC-SSL-PASSPHRASE-COMMAND-SUPPORT...
>>
>> "Setting this parameter to true might be appropriate if the passphrase
>> is obtained from a file, for example."
>>
>> Am I misunderstanding, or was the former quote missed when updating the
>> docs for pg11?
Right, that should be amended. I suspect the next sentence
Furthermore, passphrase-protected private keys cannot be used at all
on Windows.
is also related to this. Can someone comment on this?
--
Peter Eisentraut http://www.2ndQuadrant.com/
PostgreSQL Development, 24x7 Support, Remote DBA, Training & Services
^ permalink raw reply [nested|flat] 2+ messages in thread
end of thread, other threads:[~2019-04-24 18:58 UTC | newest]
Thread overview: 2+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2019-04-24 11:22 Re: Passphrase protected SSL key and reloads Joe Conway <mail@joeconway.com>
2019-04-24 18:58 ` Peter Eisentraut <peter.eisentraut@2ndquadrant.com>
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox