Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA1:256) (Exim 4.89) (envelope-from ) id 1hJFyd-0000sz-OD for pgsql-docs@arkaria.postgresql.org; Wed, 24 Apr 2019 11:22:12 +0000 Received: from localhost ([127.0.0.1] helo=malur.postgresql.org) by malur.postgresql.org with esmtp (Exim 4.89) (envelope-from ) id 1hJFyc-0005z2-CG for pgsql-docs@arkaria.postgresql.org; Wed, 24 Apr 2019 11:22:10 +0000 Received: from makus.postgresql.org ([2001:4800:3e1:1::229]) by malur.postgresql.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA1:256) (Exim 4.89) (envelope-from ) id 1hJFyc-0005vY-14 for pgsql-docs@lists.postgresql.org; Wed, 24 Apr 2019 11:22:10 +0000 Received: from mail-yw1-xc44.google.com ([2607:f8b0:4864:20::c44]) by makus.postgresql.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA1:256) (Exim 4.89) (envelope-from ) id 1hJFyZ-0001jm-75 for pgsql-docs@postgresql.org; Wed, 24 Apr 2019 11:22:08 +0000 Received: by mail-yw1-xc44.google.com with SMTP id y131so4174864ywa.9 for ; Wed, 24 Apr 2019 04:22:06 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=joeconway.com; s=google; h=subject:from:to:references:openpgp:autocrypt:message-id:date :user-agent:mime-version:in-reply-to; bh=dS/ZxCONX4UcUlZqzL41of7H/cDSJwMA382Pnrx75/0=; b=PAEdwS+/wiBtzhLVOxpRSHCIVA3hbd8SblPK3FpHXbzA0Z0W6kXiQXfphZj0Wb6LEK dlbQeNw8oLYgYhArw3OqCUX2nhNdRx4suIsHV1IPflpEYRnX2FQoslvOoeAcys9E1CHX WBWTDbpBDaqJ/y6hnFmUyZP0F+VlfZysFYuyKmVa/zMxvezKuM0mLQisyMQQL8eZHtj2 x2NJ1F2zxkwvXRSu20ngQ6stCd1Nmyy1ax6Yg63nlik2tP2gef8CiAlObVfM3MZFjQ6U wiRLFDVnlWyoS+oK9kMZFcp3vXWgowO0/FR98yuY6OAwy1F0XtzUMsK3sOZE8uo5WRQK uyqQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:from:to:references:openpgp:autocrypt :message-id:date:user-agent:mime-version:in-reply-to; bh=dS/ZxCONX4UcUlZqzL41of7H/cDSJwMA382Pnrx75/0=; b=XewvlCPtRdPLsQwTpEUxxNDYzPdgEy4TGFumOVLuX1KLs0fd7LNpobr1YX/lgOGvAY o/dpCGeBjITs3OhJIGQbMpKaDS1XqaQebKwzS2uJ4NhZT7x5S99fI+UW2cklp87OPNPJ EU0Mhp41KpSJS5rPbTtGsGwwwdw4+KJ8jRZBD4Z0zRb5VrD7FXtMT7JRGozOceFb4yiO EbbVRaGWVjvNMeQgjujtdY3xDNshqgnrIQNZtpDN6WrdzTrD19EDQ5GFjQ6rtEApSWcQ KI3hbzuPXsa14yJVuR1dexZL9XSNdgPigqNg9opKgTpUozX1bs4ADNMRQN7a++v24zBi t6hg== X-Gm-Message-State: APjAAAVBSwOgvykQmRiUwuK6VVfrczfmDpFWUhSxct/NieF/r/v5gK5u fB5qZYN8xY4nvcyhfUHiet2YDw== X-Google-Smtp-Source: APXvYqyME8zAjrdDhINDtEH86LK8vR0bRMi2TQKKvwc4+03FK+MTTeXh+p7lN/F6kaF8Up3Og4MRnw== X-Received: by 2002:a81:28cc:: with SMTP id o195mr18962637ywo.131.1556104925413; Wed, 24 Apr 2019 04:22:05 -0700 (PDT) Received: from [192.168.4.41] ([72.17.18.98]) by smtp.gmail.com with ESMTPSA id v123sm6517268ywv.89.2019.04.24.04.22.04 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 24 Apr 2019 04:22:04 -0700 (PDT) Subject: Re: Passphrase protected SSL key and reloads From: Joe Conway To: pgsql-docs , Peter Eisentraut References: <75731d49-ad04-49b0-7bf7-09c0d89c9473@joeconway.com> Openpgp: preference=signencrypt Autocrypt: addr=mail@joeconway.com; keydata= mQINBEpXMCsBEADDnXUQzjlyi/cX02Gtdy2CLcroE5CsC7DJKdOBDbfgn0kfiIYoV5JniG4l VyzZUodY8yUAagqLYolh0UkBzs9N+qkm7erde4ypw3jzVQ37BuzIvk3nMUbuDZDgxWqX+nVS sKc+BQ5BpzgCHg48leoRO2ohjvYnUhgH3j2rFZCzaj6qQ7mv+XoxOJmUlVQtG06Jwkk7Vu14 7U9nMMM6hyUKzVnmCphnlcMNo26UyVU70MwFfFJgcI0c5fpp8byN56eD6VJVnufO5WAuEhzE qcrSJR2FAlmM90GBY+6vP29twLDCHuSFvrnujNCx/BvCC/a3/gPvyAFp4JtMm9eXAmq3m/Kw 94nTJXVdcbQeQQDp3KIG7MmWS4lnGvPn8v0CjgNaLvZXFLo1FgmUVsyEq1Lww4iRLa6sbpXJ ESx15UEue1k1YZM9C+4F/o3aeKNsAienjw2EXFzcaxIg/C4P493VMi3Qa8ycVxR5iYhUbYdo DFIUQhbFNsYfrtW/qZAELT3FCYFpZYG01e9Hj+cBrXXgyDDkQ5Lq4mlvmkRvuxn61V6Au4HA 0sJiCox5pM1FvzT+aI8HY1BYaiB9Pl4fhpKgmhhlSuglk9v39S4jmlUIb45iLAUVpeNM6Qjm 69pf5da9sm4aGFa7YlDSKf/WcU7z9ITZxsilOi2n7YJiwG7kTQARAQABtB9Kb2UgQ29ud2F5 IDxtYWlsQGpvZWNvbndheS5jb20+iQI8BBMBAgAmAhsDBwsJCAcDAgEGFQgCCQoLBBYCAwEC HgECF4AFAlpoksUCGQEACgkQMyt+aLaZQ0p4XQ/9F4WSf4ZFuL3ae356ApVqnLxphHXeXHli ePZe7qosvXMQLN9Y2m5cQwqojsQh4pZujIi4Iwxw7ORg6HbMO8dMhyu8TlDavErcgO561hG7 /TCcCLf5SkadxBqYWAJH09W8S2iC3gQtS+qs4Y7sIvRi881EsPzG5Lrzu7Ei8ufqsSnbLUQk zAaKjK3IzAFvzA3VCg/8Aqhf8obhqL0j5I5DNOpAt2U4gkEzIrX1g5xSXpRLMHLEK7hPViY8 pFQyRvyZioE4hckNsnidCgiv4HefJUFRIVxDkHBeLhTzqTPloesFT/bskhckIS6F4suMx044 WTTW6UiARuWw3aaBTmxay2rjPCsGaJPawzY0O3HlNlZherCzuBpa+Qk1kMLkcxMlYjCrMgIR YyBpIK46ltPQaog4Ujh21w1Z8m/ufG5v/HTuLdXM9hGfTlW7aY6psCAV/MwfycDHLRMc+UY7 W2cp6DlWQ7GHLP+vzvBcl5Odi04EhcYnHMZjKvRFsxhE0LZcTejrtxPkDgR9G59irlIx1+py ziK2B0hs7Er1Yq7qQGQiQGLoglSNDsvsUeyMGyabasmUd5xrRO35SpGv+hyYGAZ3Pyk9Vtxl CO7BJkZiV9YSMHp6hOdmYZd4SZRChd9sKd6eSw1xIlBALz1ZHuQVMBuZvuVGFsS81Zqckb/2 D5q5Ag0ESlcx7QEQAKhm5UhGfbe3hM4yCaa/pPaNaswlB2tK1DHAjDlDm7gDVEodfsrvAFUU unLodlvCd0g/GpLmXXdROU/I+HusVqQhDbVeHMwO2VUVHamRWqDfrCjMYVxLz80d96TYyeyW 6RUNkJmXJAOKgy8veI7Z1F+j1gXQR7UlzonnSkWbs0oQ3RglvyqhkUzWtXU7F+j2hQ2vQsct Lnq3lYo0bYkZ3K6RyKZXSly9Hd7DzYkMzz7StNRlyeQJxplPrVPup7N8SqDrI126sq0cwdUB Gn1sKVoO+bGidBjhJgxouNPkMJlPjbKOgb7tv5ZnM33FGXNdC5sPKoZ4mC+gaqRHYaH/V61v fCo1CYNLIK+Cj+Oua8mQ6CPeOb5VKcJ0JM96eGNlzF9EawppOG7xCDcbmBEr0m1go9MHEUel 0L1i8RSDYOHQQkLT2MVWYf4UsRlEGbME+kF7DEX9Fvie7qglFTXC2d+YVN73AnXcoM/IYUOR DXjVVaqQoHuA4uxwJ31o/rEaOihr2yCScr8mB8J3b3KyNfuCBm5gN0tUQw+t5szMYurDpZ1G L4O7btaQ5u4iJMfRTCnPrzW+wkdVrao7AmRNWEtSlXsycClKFCHz/Ej5rpXOKSp+a/xcaFX1 v2eS/+Ujp5ESu9p57JwlP6aSqYBiOALRJXZ9DVtZL96okjzXjrd7ABEBAAGJBD4EGAEIAAkF AkpXMe0CGwICKQkQMyt+aLaZQ0rBXSAEGQEIAAYFAkpXMe0ACgkQN/L3QzX32GV1Jw//fhvL Mk1YNS/2N5jc5HYmEjcL2OWBLLrO5RMCaOgCNmYsepkigy2U+GSloVy8Y40/UfYzIoNf1DiB Qyj5Ipa4eMjfKA7+1q43a5wkDDWogFNflKTTNemwrHDKR1WWDrxt8uAgJdlBGDQA7A0q3D2i Xhd7ALLOHhuXDY1++N9TK9KMfV90Oay0mIMLQhTG/UgsgrYYb78H2pk8XMYZY29vgZlj9VH2 f1RpOoh7lCaB+2glN27Rzh17q0/zEjwXk4sDyYHRIycaqnM4ozSnliXyoWM5bvmqSGBCm5jl BjNW+cFbFy15U595AIXXiUXl8hsTF2JWwgHr+hYdtoEH3oEOxzM18ENXKTTgN+BafdMsah4e HIcVvrVrH6rlsPwCvk3o/PJ07qVbUW+dbZG8UB1JwqUUqGhrCk87kztajlvZGZWxWDSB4Lnb T6Jc0L7/YXG8U3sJ2OtZ95Lal5XfNo0yBdPflmalH3xf/EcxaYFETbDrY5UgEVa2HBw8XzKk rTbM8rD318M+jBOuL6o3cGMOeFOm4C51fJZmOCFd03LhMkoj9IbLIPGKosIBsxb7zP5YLAbI b3el6pvo9CKtNuR+IcVOoFtH+KVOxGsbbxFEFbsAmPMreF1hIv+l+HXBaDhUkaUmpJ1Mhxol aM6O/LGG4VQV7wBQFunVaN8EPqMqYDph3A//TjQVd8fqvw5Ezj1958IUmV0jxeGX2m/fspGh njF+6Adx3PFbZoKyW71cA/TnlHVYCaizjYYRNMC3g5VFytOYOZFi0GKsxQTX5PcPhDjFFTUv FVVZwDYUK3QlC+wGDTeNWfAJIZnTPPIXSiHzh3si+ngKjE+ngcRF1VY5K4xvc6ss6uq8kI8L Ct+TpOMr99ijaYEbMZ8WJagynD5BLNYxpP6CCTMDi1Xqydg0E/mhR9w9aUOvdTZw1OOKtLnz B1E0wFbzJXEvjP2eEVNlStS5RTawFDpqxGwXJcHqe8qtg8B+C1r47RmHnKKm+DTOPFQWTj83 l775aNMzAHm+Pr1TdSA5XRyQ3wxwYKfhp1suKhILUZLjbiCQf92RZQ6yEdXskMr2A4n0GQWq Q8k7r9QPqtUP7lsiyyDem7r9h5mAm94r3Td22L3JaSHkBD+4jC4gIXeYoyd+lTz/zYOx0Fri J8dXHalmyTGsSxV7FXv1/thVEf6R7TDdVwhqf/WL3uWTmVBR0tJscG+9iCVch/OG/uCDkWZQ sOTotqj6f5jSZI+NOUqt62+8i8gjYEa7zRZ2HXFOTV8UduCjheWB2VCUj5EjFjTMjfTVkyZ5 SiFht7bM5l/odoYU6vn37/5s/ZsMTZX1zG5oXv6iULrHLYHhUxR93FlVyn4DiHsWND/Idj65 Ag0ESlcyJwEQAOkTBb9yDhJbMUgvhM11rZwT5tm4Y9TqtEHn0Zy3t9g7bdFFpMvav/KENd3o AtLFpMDf+H3AggFk4ftUwJwiVgJ88ilvCynJUGXiuYIaexY4DLgn4xpnuiEpYEFVdWnlw7dW VTc62exfqIz9bSWRzwfBCY9ruYGEb4RDPDSNSAVyI7sxHzef2asiYxIcxrTrw5VugWNlPZcV 5/EJ6PUvATjBF2TBkXV7KOciQng2tsQGrGMkY5mduNqwpuh6zfPcVF8LeObe96wv5ZhPRpO7 9nef7hnK2lJogp3JIo558Jlbz9WHtQEMZR85+bUhtI825QyNAFz3Jrn7NMgvDikc2OrWo7YM gMC5hDSWVFqA6/EQCNnDWGABWgeYHZFpnPwsvUWIYdhSilUuj/Tuzvz9ZmucFNbQbauDQw6V Q38ofGnoYDZFJsGncprB8dBi4tDrIQ+1RlIh6C2Z/eMipqJOT26+spluTjouvnKT0S5yOgyX 0PjbsysgwQdCGNJLHOjhHbSpSmOLaduV3CQo/0+DHT/TBjYfIXjTWouY9TkGxG4eNrxU0u2x Ay5bMqOPmsFdjLTWlQUlF/fTMhB54XwI3FHWgnSnXZzStDTmTebLNdT/ftgliAzA81uMj49j 0exv731/v+7udLA1bV8gnZ01zQCASDpWiRQR3fgwcugSUqgRABEBAAGJAh8EGAEIAAkFAkpX MicCGwwACgkQMyt+aLaZQ0pwAQ//bjcWnZg/jjRQ9gbZUGMqniItZYRglBMKIqt4Fia379Jm HwTvavnFkJ8XMZ56UB0FIrgS+sUkRH6cPRQR+7Qi392LD021DXgSsz9CwFHjFyBGHwLEOTRc fYQbtJy0shHDJB4aQTOX3ERDH1PsvJNuevmQMzS0DWFav9+xMz9rKP4N+HffoBIZE0C1xIE4 3nD4eLsbycte9sVIrmlNuUti3qUxJAQw8HwfJ6ZbBInHxquApR16uD1u99o6XlndFrDlY22t RmHCM0bR81GfGNdcU3Uo+rG/R/k4qa7s9/dgKvMbyH3fHhp/ceKag80Xo8IFurRl0ZJP3sHJ 2QDHCVLat7jRZ+43hi1WlIhFbrgn6IyI0i7XR/W8JjrC5MsKq4TUwGH077sU/kcHYebVJZRb UUst2hAGHDFVBcG12qoKf+ltL9qXJc1y7BGeCoUW6QjOpljpq6ZL4FQUsM0RSRjs5egE3szP cIf5SyPK6WDOApoAq6M7BBFMGDZwEylYMtr0YekA1u86UA9D2xwLHEbBBp/uiby1c9JbPJ1P n8zJP8WZNeRw4Q9TtqVK09+oLirMUSpIDd6KdZ1VgRxOK2re7tjDvkVuYsSrsiJ+1iJNEnp9 iK0ok0DlJpSCe6KhkxpaTdeoWMXdKuJWec0NIqoAd54ZgBPnr+UPxTixgPq/p6Q= Message-ID: Date: Wed, 24 Apr 2019 07:22:03 -0400 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.6.1 MIME-Version: 1.0 In-Reply-To: <75731d49-ad04-49b0-7bf7-09c0d89c9473@joeconway.com> Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="uyA4Tv5S6PKdyGkEFAvPwZ3GkbMlqooRQ" List-Id: List-Help: List-Subscribe: List-Post: List-Owner: List-Archive: Precedence: bulk This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --uyA4Tv5S6PKdyGkEFAvPwZ3GkbMlqooRQ Content-Type: multipart/mixed; boundary="MzyT0jPzVEgouIzHdK14FkIyJAeqxUkrK"; protected-headers="v1" From: Joe Conway To: pgsql-docs , Peter Eisentraut Message-ID: Subject: Re: Passphrase protected SSL key and reloads References: <75731d49-ad04-49b0-7bf7-09c0d89c9473@joeconway.com> In-Reply-To: <75731d49-ad04-49b0-7bf7-09c0d89c9473@joeconway.com> --MzyT0jPzVEgouIzHdK14FkIyJAeqxUkrK Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: quoted-printable (moved from Hackers to docs) On 1/5/19 4:26 PM, Joe Conway wrote: > On https://www.postgresql.org/docs/11/ssl-tcp.html it says: >=20 > "Using a passphrase also disables the ability to change the server's > SSL configuration without a server restart." >=20 > But as of pg11 we have ssl_passphrase_command_supports_reload, which as= > I understand it should allow this if the passphrase command is not > interactive. Per > https://www.postgresql.org/docs/11/runtime-config-connection.html#GUC-S= SL-PASSPHRASE-COMMAND-SUPPORTS-RELOAD >=20 > "Setting this parameter to true might be appropriate if the passphras= e > is obtained from a file, for example." >=20 > Am I misunderstanding, or was the former quote missed when updating the= > docs for pg11? Since I am already thinking about pgsql-docs today -- any comment on this= ? Joe --=20 Crunchy Data - http://crunchydata.com PostgreSQL Support for Secure Enterprises Consulting, Training, & Open Source Development --MzyT0jPzVEgouIzHdK14FkIyJAeqxUkrK-- --uyA4Tv5S6PKdyGkEFAvPwZ3GkbMlqooRQ Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEg14x9eymXoJyHrH+N/L3QzX32GUFAlzARtsACgkQN/L3QzX3 2GWauA/9FIH536yT0wudiYyQ4Qi/Fcr18b3Tsxb2t/W2GezMt7Qt9LYYW0SejTlD 9s7JCvuf60261H5rO+/rYxYcZpoYXgDb3V+8p4YS6VDalojW0+a+6Y8gW1ZQ0pIO IRuU4B7/hSU0MKqAV/gemhB36H1LNLYwfE4InvyT36Nz2rrNeH6yQQhKedvGxVbn Ut7oOC8CP8N+c89pEBgQuTJy6rb8uloICTxPaPz1h02TaklysUvsXBKr7ST7BJIX oUKycu0Avydwco/Uh7oWo5iwk6eTzBu8hSZh32htUPj+mMd1JroPPXnREcBQmGMA 1Dl62O2EQZFobJrRwqF2W31lpQNUJMpZkpskezvYdtapiMzZBFvz/q6ngW/Uog3C yAjlMW7K2JxZo5KB9qiRZvB6C2IGXg5PVCQqcGqD+GTle82rOMtUsnFmBHasgo6H nRP8PCVU0rPzPFYxTQ/kEye+1vhCb0mXVqnwE+60UrBZuOdl/hML0qUN0pcz27Ac DUa0RGduKwpxg9ll13WqQUyByQvHgkj41JAWzxWk076Pob1tSj4seDbsL4AUDPb7 cLqrimbzdqiOdbpTFjfivC1BqfRXqEaD2dtjIjp5QvKJj7Xeyv25fIu9D2PjB1/d bgrYLVjoiDCQamDdDM9J+tuRM5KuU+rJWLBBV+yqs13pu7nBCdQ= =tx7x -----END PGP SIGNATURE----- --uyA4Tv5S6PKdyGkEFAvPwZ3GkbMlqooRQ--