From: Victor Wagner <vitus@wagner.pp.ru>
To: pgsql-hackers@postgresql.org
Subject: Re: [PATCH] Reload SSL certificates on SIGHUP
Date: Wed, 7 Sep 2016 13:53:17 +0300
Message-ID: <20160907135317.05857de0@fafnir.local.vm> (raw)
In-Reply-To: <CAB7nPqQkLj1rbjv5_MiER0-Snmpv2nQDEXMiO1QFY3==noCk1A@mail.gmail.com>
References: <556A6E8A.9030400@proxel.se>
<55956342.9050408@gmx.net>
<55AEE95E.7090304@proxel.se>
<55B82208.4090901@gmx.net>
<8917.1438133076@sss.pgh.pa.us>
<55BAA50E.5040908@proxel.se>
<28784.1440554271@sss.pgh.pa.us>
<CAB7nPqSkP=n-s=EYqnKTRx5MY_KgP8JF-OLpjni+O=xAYVKBhA@mail.gmail.com>
<CAB7nPqQcttyXYuRAyDNqDOjPDKjgOyg4DVvns9cof4MjbxP_-w@mail.gmail.com>
<56528809.1060501@proxel.se>
<CAM3SWZS2UonZmW5G2teRfUwh2mXnmAODdSe_iW=BP+dXt_bSkQ@mail.gmail.com>
<10e2fa4c-08dd-8157-aca7-6448c8663403@proxel.se>
<CAB7nPqQkLj1rbjv5_MiER0-Snmpv2nQDEXMiO1QFY3==noCk1A@mail.gmail.com>
List-Unsubscribe: <mailto:majordomo@postgresql.org?body=unsub%20pgsql-hackers>
On Wed, 7 Sep 2016 17:09:17 +0900
Michael Paquier <michael.paquier@gmail.com> wrote:
> On Sun, Sep 4, 2016 at 11:39 PM, Andreas Karlsson <andreas@proxel.se>
> wrote:
> > 1) Serialize the certificates, key, and CRL and write them to the
> > backend_var temp file and then deserialize everything in the
> > backends.
> >
> > Sounds like you would need to write some code for every SSL library
> > to support the serialization and deserialization, which I am not a
> > fan of doing just for one platform since I worry about little used
> > code paths. Additionally this would mean that we write a copy of
> > the private key to potentially another file system than the one
> > where the private key is stored, this sounds like a bad idea from a
> > security point of view.
>
> Yeah... This would result in something that is heavily SSL-dependent,
> which would be an additional maintenance pain when trying to support
> future OpenSSL versions.
OpenSSL has documented API for serializing/deserializing each and every
cryptographic format it supports. And this API quite unlikely to change
in future OpenSSL versions. Moreover, LibreSSL is compatible with this
API as far as I know.
Really, Apache does simular thing for ages - it starts as root, loads
certificates and keys, serializes them in memory, then forks and drops
privileges, and then uses these keys and certificates.
There are two problems with this approach
1. You have to carefully design data structures to store serialized
keys. Apache made a mistake there and didn't allow for future invention
of new public key algorithms. So, in 2008 I had problems adding
russian GOST cryptography there.
2. You keys and certificates might not be stored in the filesystem at
all. They can live in some hardware cryptography module, which don't
let private keys out, just provide some handle.
(OpenSSL supports it via lodable engine modules, and Postgres allows to
use engine modules since 8.2, so people can use it with postgres).
Really OpenSSL/LibreSSL provide useful abstraction of memory BIO (Where
BIO stands for basic input/output) which can be used to store
serialized cryptographic data. And serializing/deserializing API is
designed to work with BIO anyway.
--
Sent via pgsql-hackers mailing list (pgsql-hackers@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-hackers
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: vitus@wagner.pp.ru
Subject: Re: [PATCH] Reload SSL certificates on SIGHUP
In-Reply-To: <20160907135317.05857de0@fafnir.local.vm>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox