Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtp (Exim 4.84_2) (envelope-from ) id 1cOQCD-00030p-JJ for pgsql-hackers@arkaria.postgresql.org; Tue, 03 Jan 2017 14:36:13 +0000 Received: from localhost ([127.0.0.1] helo=postgresql.org) by malur.postgresql.org with smtp (Exim 4.84_2) (envelope-from ) id 1cOQCD-00044x-61 for pgsql-hackers@arkaria.postgresql.org; Tue, 03 Jan 2017 14:36:13 +0000 Received: from magus.postgresql.org ([2a02:c0:301:0:ffff::29]) by malur.postgresql.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA384:256) (Exim 4.84_2) (envelope-from ) id 1cOQAo-0002QJ-35 for pgsql-hackers@postgresql.org; Tue, 03 Jan 2017 14:34:46 +0000 Received: from out2-smtp.messagingengine.com ([66.111.4.26]) by magus.postgresql.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA384:256) (Exim 4.84_2) (envelope-from ) id 1cOQAk-0000gy-BW for pgsql-hackers@postgresql.org; Tue, 03 Jan 2017 14:34:45 +0000 Received: from compute7.internal (compute7.nyi.internal [10.202.2.47]) by mailout.nyi.internal (Postfix) with ESMTP id 826A720C10; Tue, 3 Jan 2017 09:34:39 -0500 (EST) Received: from frontend1 ([10.202.2.160]) by compute7.internal (MEProxy); Tue, 03 Jan 2017 09:34:39 -0500 DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d= messagingengine.com; h=cc:content-transfer-encoding:content-type :date:from:in-reply-to:message-id:mime-version:references :subject:to:x-me-sender:x-me-sender:x-sasl-enc:x-sasl-enc; s= smtpout; bh=IqnRgCrfQNLN/9oQTxXdnWboz7M=; b=cB/pqQIcEo1EAJU+MG3w lMu2Bw9v5CLnBtAeyYlDeo/+VByXrOYwKz2ah3UZoiNRt1oLBWWXs80tVHtXAS2c C/9ZCtvmEtSsWNp8x7CjBs5NqSS8ojlFLPMKPqWEAc60/trCS0xwgIqQXA2mSgTJ HqsmpOPRi+eXMKbveXzvH5M= X-ME-Sender: X-Sasl-enc: 80rSjwcBDAmcY0Wh6NNP49rXsXXRG3dJajO/WGKzJdNL 1483454079 Received: from april.local (c-73-13-66-39.hsd1.pa.comcast.net [73.13.66.39]) by mail.messagingengine.com (Postfix) with ESMTPA id 250577EE38; Tue, 3 Jan 2017 09:34:39 -0500 (EST) Subject: Re: [PATCH] Reload SSL certificates on SIGHUP To: Tom Lane References: <28784.1440554271@sss.pgh.pa.us> <861d27e2-a642-2725-ae31-e375962ab700@proxel.se> <0927799d-9f32-7b40-4fe3-04a281365b7a@proxel.se> <2c1d1551-fd71-113f-7f45-f2379884bf85@proxel.se> <6d45be21-637b-c802-75e7-1ea634ed4089@proxel.se> <05677cd3-63b2-b15b-7afd-798e34e607c7@proxel.se> <16e282a4-2573-f629-09e8-e6b0ac615890@2ndquadrant.com> <29982.1483412575@sss.pgh.pa.us> Cc: Michael Paquier , Andreas Karlsson , Michael Banck , Peter Geoghegan , PostgreSQL-development From: Peter Eisentraut Organization: 2ndQuadrant Message-ID: Date: Tue, 3 Jan 2017 09:34:38 -0500 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:45.0) Gecko/20100101 Thunderbird/45.6.0 MIME-Version: 1.0 In-Reply-To: <29982.1483412575@sss.pgh.pa.us> Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: 7bit X-Pg-Spam-Score: -2.6 (--) List-Archive: List-Help: List-ID: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: X-Mailing-List: pgsql-hackers Precedence: bulk Sender: pgsql-hackers-owner@postgresql.org On 1/2/17 10:02 PM, Tom Lane wrote: > Before we leave this area, though, there is a loose end that requires > more thought. That is, what about passphrase-protected server keys? I don't have experience with this in practice, but my hunch would be that you can continue to use passphrases as before, but the new reload functionality is effectively not supported. That is, if you use passphrases and make a key change, you need to do a full restart. -- Peter Eisentraut http://www.2ndQuadrant.com/ PostgreSQL Development, 24x7 Support, Remote DBA, Training & Services -- Sent via pgsql-hackers mailing list (pgsql-hackers@postgresql.org) To make changes to your subscription: http://www.postgresql.org/mailpref/pgsql-hackers