From: Stephen Frost <sfrost@snowman.net>
To: Andreas Karlsson <andreas@proxel.se>
Cc: Magnus Hagander <magnus@hagander.net>
Cc: Tom Lane <tgl@sss.pgh.pa.us>
Cc: Peter Eisentraut <peter.eisentraut@2ndquadrant.com>
Cc: Michael Paquier <michael.paquier@gmail.com>
Cc: Michael Banck <michael.banck@credativ.de>
Cc: Peter Geoghegan <pg@heroku.com>
Cc: PostgreSQL-development <pgsql-hackers@postgresql.org>
Subject: Re: [PATCH] Reload SSL certificates on SIGHUP
Date: Wed, 4 Jan 2017 10:18:50 -0500
Message-ID: <20170104151850.GQ18360@tamriel.snowman.net> (raw)
In-Reply-To: <1254e97b-a65a-5a63-e938-810507a16d71@proxel.se>
References: <16e282a4-2573-f629-09e8-e6b0ac615890@2ndquadrant.com>
<29982.1483412575@sss.pgh.pa.us>
<CABUevExczKi876tfqH5dY7QcMQu6v3KFBwckozD_OJr0kgVidw@mail.gmail.com>
<23913.1483458895@sss.pgh.pa.us>
<CABUevEzWtbL8PqcYXEagCVH_NHYQdMcXqZv4GXEeCW=kkd-J0Q@mail.gmail.com>
<20995.1483541230@sss.pgh.pa.us>
<CABUevExdkO3TTLYhc2oQAOWXbnz+mJ8=Tfg+WsB2P6p-_wfYyg@mail.gmail.com>
<7fca80da-0274-3f36-eb25-d53f940c1977@proxel.se>
<20170104151429.GP18360@tamriel.snowman.net>
<1254e97b-a65a-5a63-e938-810507a16d71@proxel.se>
List-Unsubscribe: <mailto:majordomo@postgresql.org?body=unsub%20pgsql-hackers>
* Andreas Karlsson (andreas@proxel.se) wrote:
> On 01/04/2017 04:14 PM, Stephen Frost wrote:
> >* Andreas Karlsson (andreas@proxel.se) wrote:
> >>A possible solution might be to only add the error throwing hook
> >>when loading certificates during SIGHUP (and at Windows) and to work
> >>as before on startup. Would that be an acceptable solution? I could
> >>write a patch for this if people are interested.
> >
> >I'm not sure I see how that's a solution..? Wouldn't that mean that a
> >SIGHUP with an encrypted key would result in a failure?
> >
> >The solution, at least in my view, seems to be to say "sorry, we can't
> >reload the SSL stuff if you used a passphrase to unlock the key on
> >startup, you will have to perform a restart if you want the SSL bits to
> >be changed."
>
> Sorry, I was very unclear. I meant refusing the reload the SSL
> context if there is a pass phrase, but that the rest of the config
> will be reloaded just fine. This will lead to some log spam on every
> SIGHUP for people with a pass phrase but should otherwise work as
> before.
Right, that sounds like it'd work for me, at least.
Thanks!
Stephen
Attachments:
signature.asc (application/pgp-signature, 818B) download
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: sfrost@snowman.net, andreas@proxel.se, magnus@hagander.net, tgl@sss.pgh.pa.us, peter.eisentraut@2ndquadrant.com, michael.paquier@gmail.com, michael.banck@credativ.de, pg@heroku.com
Subject: Re: [PATCH] Reload SSL certificates on SIGHUP
In-Reply-To: <20170104151850.GQ18360@tamriel.snowman.net>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox