pg.ddx.io  pgsql-hackers@postgresql.org mailing list archive  

help / color / mirror / Atom feed
From: Tom Lane <tgl@sss.pgh.pa.us>
To: Robert Haas <robertmhaas@gmail.com>
Cc: Stephen Frost <sfrost@snowman.net>
Cc: Peter Eisentraut <peter.eisentraut@2ndquadrant.com>
Cc: Andreas Karlsson <andreas@proxel.se>
Cc: Magnus Hagander <magnus@hagander.net>
Cc: Michael Paquier <michael.paquier@gmail.com>
Cc: Michael Banck <michael.banck@credativ.de>
Cc: Peter Geoghegan <pg@heroku.com>
Cc: PostgreSQL-development <pgsql-hackers@postgresql.org>
Subject: Re: [PATCH] Reload SSL certificates on SIGHUP
Date: Thu, 05 Jan 2017 11:55:16 -0500
Message-ID: <5359.1483635316@sss.pgh.pa.us> (raw)
In-Reply-To: <CA+TgmoYj=8F+Aa0JpR3MdtMP5Yf0uN=+S1+y-HRPUGiQT_2=dg@mail.gmail.com>
References: <CABUevEzWtbL8PqcYXEagCVH_NHYQdMcXqZv4GXEeCW=kkd-J0Q@mail.gmail.com>
	<20995.1483541230@sss.pgh.pa.us>
	<CABUevExdkO3TTLYhc2oQAOWXbnz+mJ8=Tfg+WsB2P6p-_wfYyg@mail.gmail.com>
	<7fca80da-0274-3f36-eb25-d53f940c1977@proxel.se>
	<20170104151429.GP18360@tamriel.snowman.net>
	<1254e97b-a65a-5a63-e938-810507a16d71@proxel.se>
	<22644.1483543579@sss.pgh.pa.us>
	<cf2ea102-13cd-d51a-8dfe-dfe6b9269e63@2ndquadrant.com>
	<23703.1483545440@sss.pgh.pa.us>
	<97c1bad2-ac72-052a-0525-1d115f094f15@2ndquadrant.com>
	<20170104164958.GR18360@tamriel.snowman.net>
	<CA+TgmoYj=8F+Aa0JpR3MdtMP5Yf0uN=+S1+y-HRPUGiQT_2=dg@mail.gmail.com>
List-Unsubscribe: <mailto:majordomo@postgresql.org?body=unsub%20pgsql-hackers>

Robert Haas <robertmhaas@gmail.com> writes:
> Of course, if there's some sort of commonly-used library out there for
> this sort of thing where we can just link against it and call whatever
> APIs it exposes, that might be a better alternative, or something to
> support in addition, but I don't really know whether there's any
> standardization in this area.

I was wondering if we could make use of ssh-agent.  But it seems to want
to hold the private key itself, so that you have to communicate with it
every time you need an operation done with the key.  I'm not sure what the
performance of that is like, and I am sure that the code would look a
whole lot different from the path where we hold the key locally.  It might
be workable if OpenSSL already incorporates library routines for talking
to ssh-agent, but I haven't looked.

			regards, tom lane


-- 
Sent via pgsql-hackers mailing list (pgsql-hackers@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-hackers



view thread (69+ messages)

Message-ID: <5359.1483635316@sss.pgh.pa.us>
Permalink:  ../5359.1483635316@sss.pgh.pa.us/
Also on:    postgresql.org/message-id/5359.1483635316@sss.pgh.pa.us

 · 

reply
Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: pgsql-hackers@postgresql.org
  Cc: tgl@sss.pgh.pa.us, robertmhaas@gmail.com, sfrost@snowman.net, peter.eisentraut@2ndquadrant.com, andreas@proxel.se, magnus@hagander.net, michael.paquier@gmail.com, michael.banck@credativ.de, pg@heroku.com
  Subject: Re: [PATCH] Reload SSL certificates on SIGHUP
  In-Reply-To: <5359.1483635316@sss.pgh.pa.us>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox