Sender: =?UTF-8?Q?Anders_=C3=85strand?= <anders@karrdal.com>
From: "=?UTF-8?Q?Anders_=C3=85strand?=" <anders@449.se>
Message-ID: <eb921cc4-ca10-4d07-a84f-e164c243073e@449.com>
Date: Mon, 16 Feb 2026 12:12:08 +0100
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
Subject: Re: Follow-up on OpenSSL "engines" and "providers"
To: Daniel Gustafsson <daniel@yesql.se>, Bear Giles <bgiles@coyotesong.com>
Cc: PostgreSQL Hackers <pgsql-hackers@postgresql.org>
References: <CALBNtw6tVo+WekdeaZdcXFqUPGSse_NkFT-eMyKMGs4ezu+tqQ@mail.gmail.com>
 <285A986D-C9A4-40DF-9061-B084ADA2C61E@yesql.se>
Content-Language: en-US
In-Reply-To: <285A986D-C9A4-40DF-9061-B084ADA2C61E@yesql.se>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit
Archived-At: <https://www.postgresql.org/message-id/eb921cc4-ca10-4d07-a84f-e164c243073e%40449.com>
Precedence: bulk

> FWIW there has been discussion among those of us who regularly dip our toes in
> the OpenSSL support code to add some form of integration with vaults (like
> vault from Hashicorp, ipa/idm from Redhat, Keychain from Apple etc) for storing
> secrets.  AFAIK there are no concrete patches to look at (yet?), but there is
> interest and it will most likely be discussed at PGConf.dev in case you are
> thinking of attending.

I've been toying with the idea of building a key manager extension that could be used by others to get hold of secrets or use encryption keys without necessarily having to know where those secrets would be stored. It could use loadable shared libraries for the different providers similar to how we do it for OAuth.

I don't believe this code would have to start out in core at all, but maybe we will want to integrate it later for reasons.

-- 

Anders Åstrand
Percona