From: Tom Lane <tgl@sss.pgh.pa.us>
To: Robert Haas <robertmhaas@gmail.com>
cc: Stephen Frost <sfrost@snowman.net>,
        Peter Eisentraut <peter.eisentraut@2ndquadrant.com>,
        Andreas Karlsson <andreas@proxel.se>,
        Magnus Hagander <magnus@hagander.net>,
        Michael Paquier <michael.paquier@gmail.com>,
        Michael Banck <michael.banck@credativ.de>,
        Peter Geoghegan <pg@heroku.com>,
        PostgreSQL-development <pgsql-hackers@postgresql.org>
Subject: Re: [PATCH] Reload SSL certificates on SIGHUP
In-reply-to: 
 <CA+TgmoYj=8F+Aa0JpR3MdtMP5Yf0uN=+S1+y-HRPUGiQT_2=dg@mail.gmail.com>
References: 
 <CABUevEzWtbL8PqcYXEagCVH_NHYQdMcXqZv4GXEeCW=kkd-J0Q@mail.gmail.com>
 <20995.1483541230@sss.pgh.pa.us>
 <CABUevExdkO3TTLYhc2oQAOWXbnz+mJ8=Tfg+WsB2P6p-_wfYyg@mail.gmail.com>
 <7fca80da-0274-3f36-eb25-d53f940c1977@proxel.se>
 <20170104151429.GP18360@tamriel.snowman.net>
 <1254e97b-a65a-5a63-e938-810507a16d71@proxel.se>
 <22644.1483543579@sss.pgh.pa.us>
 <cf2ea102-13cd-d51a-8dfe-dfe6b9269e63@2ndquadrant.com>
 <23703.1483545440@sss.pgh.pa.us>
 <97c1bad2-ac72-052a-0525-1d115f094f15@2ndquadrant.com>
 <20170104164958.GR18360@tamriel.snowman.net>
 <CA+TgmoYj=8F+Aa0JpR3MdtMP5Yf0uN=+S1+y-HRPUGiQT_2=dg@mail.gmail.com>
Comments: In-reply-to Robert Haas <robertmhaas@gmail.com>
	message dated "Thu, 05 Jan 2017 11:15:24 -0500"
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <5358.1483635316.1@sss.pgh.pa.us>
Date: Thu, 05 Jan 2017 11:55:16 -0500
Message-ID: <5359.1483635316@sss.pgh.pa.us>
Precedence: bulk
Sender: pgsql-hackers-owner@postgresql.org

Robert Haas <robertmhaas@gmail.com> writes:
> Of course, if there's some sort of commonly-used library out there for
> this sort of thing where we can just link against it and call whatever
> APIs it exposes, that might be a better alternative, or something to
> support in addition, but I don't really know whether there's any
> standardization in this area.

I was wondering if we could make use of ssh-agent.  But it seems to want
to hold the private key itself, so that you have to communicate with it
every time you need an operation done with the key.  I'm not sure what the
performance of that is like, and I am sure that the code would look a
whole lot different from the path where we hold the key locally.  It might
be workable if OpenSSL already incorporates library routines for talking
to ssh-agent, but I haven't looked.

			regards, tom lane


-- 
Sent via pgsql-hackers mailing list (pgsql-hackers@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-hackers