From: Tom Lane <tgl@sss.pgh.pa.us>
To: Magnus Hagander <magnus@hagander.net>
cc: Peter Eisentraut <peter.eisentraut@2ndquadrant.com>,
        Michael Paquier <michael.paquier@gmail.com>,
        Andreas Karlsson <andreas@proxel.se>,
        Michael Banck <michael.banck@credativ.de>,
        Peter Geoghegan <pg@heroku.com>,
        PostgreSQL-development <pgsql-hackers@postgresql.org>
Subject: Re: [PATCH] Reload SSL certificates on SIGHUP
In-reply-to: 
 <CABUevEzWtbL8PqcYXEagCVH_NHYQdMcXqZv4GXEeCW=kkd-J0Q@mail.gmail.com>
References: <28784.1440554271@sss.pgh.pa.us>
 <CAB7nPqRFffNTnTo5indiY_5oRavF-XN1vN1JC9WZeUYW3ZYqaw@mail.gmail.com>
 <8b967b1e-4bdf-5fd7-9ccb-ce4cfa1d2b3a@proxel.se>
 <861d27e2-a642-2725-ae31-e375962ab700@proxel.se>
 <fb936d6f-6b83-702f-0b46-6aeef64bf7d3@proxel.se>
 <CAB7nPqSFMTfOdWev=+pTHQAb7bSoYBnm-=+CD5ay59v4c4JvUw@mail.gmail.com>
 <cf48a889-e890-0441-a1ed-57aea18c4b23@proxel.se>
 <0927799d-9f32-7b40-4fe3-04a281365b7a@proxel.se>
 <CAB7nPqT0pufs3b9W5XMMDEJ4XXDbN2x73Cpm-XaZCzwGTXRFeA@mail.gmail.com>
 <CAB7nPqQq_TUe4v0U_jPAYo5xkEo9Qnj94U5sddeRBtjSPMXXQQ@mail.gmail.com>
 <2c1d1551-fd71-113f-7f45-f2379884bf85@proxel.se>
 <CAB7nPqR=8Q9FSbj8PL2oOL2FRmAiqOh8Tqj6tuyqDard4zeuXA@mail.gmail.com>
 <CAB7nPqTHXFJATf+aeqDLRAA_6Y5p2v6AoV_AtNy=ZdCjxOjyEQ@mail.gmail.com>
 <6d45be21-637b-c802-75e7-1ea634ed4089@proxel.se>
 <CAB7nPqThxqDOt_pmJ0d4hHogtmZg=uh=Toez+WyOZzwaCZNSCg@mail.gmail.com>
 <05677cd3-63b2-b15b-7afd-798e34e607c7@proxel.se>
 <CAB7nPqQU50-UMuFcffmynDbH7_kBx3N-Q3ujL-nM2OF3X8biMA@mail.gmail.com> !
 <16e282a4-2573-f629-09e8-e6b0ac615890@2ndquadrant.com>
 <29982.1483412575@sss.pgh.pa.us>
 <CABUevExczKi876tfqH5dY7QcMQu6v3KFBwckozD_OJr0kgVidw@mail.gmail.com>
 <23913.1483458895@sss.pgh.pa.us>
 <CABUevEzWtbL8PqcYXEagCVH_NHYQdMcXqZv4GXEeCW=kkd-J0Q@mail.gmail.com>
Comments: In-reply-to Magnus Hagander <magnus@hagander.net>
	message dated "Wed, 04 Jan 2017 14:46:11 +0100"
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <20994.1483541230.1@sss.pgh.pa.us>
Date: Wed, 04 Jan 2017 09:47:10 -0500
Message-ID: <20995.1483541230@sss.pgh.pa.us>
Precedence: bulk
Sender: pgsql-hackers-owner@postgresql.org

Magnus Hagander <magnus@hagander.net> writes:
> On Tue, Jan 3, 2017 at 4:54 PM, Tom Lane <tgl@sss.pgh.pa.us> wrote:
>> I think probably the right thing for now is to install a do-nothing
>> callback, so that at least we don't have the issue of the postmaster
>> freezing at SIGHUP.  If someone feels like trying to revive support
>> of passphrase-protected server keys, that would be a perfectly fine
>> base to build on; they'd need a callback there anyway.

> Does it still support passphrase protected ones on startup, or did that get
> thrown out with the bathwater?

It does not; what would be the point, if the key would be lost at SIGHUP?

> I think that's definitely a separate thing
> and there are a nontrivial number of people who would be interested in a
> setup where they can use a passphrase to protect it initially, just not
> reload it.

If any of those number of people want to step up and design/implement
a non-broken solution for passphrases, that'd be fine with me.  But
I would want to see something that's actually a credible solution,
allowing the postmaster to be started as a normal daemon.  And working
on Windows.

			regards, tom lane


-- 
Sent via pgsql-hackers mailing list (pgsql-hackers@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-hackers