Re: How to change the TLS certificate/key without restarting the server?

On 2019-10-17 07:20, raf wrote:
> https://www.postgresql.org/docs/12/ssl-tcp.html says:
>
> "Using a passphrase also disables the ability to
> change the server's SSL configuration without a
> server restart."

This is actually no longer true since PostgreSQL 11. I have committed a
fix.

> How is key TLS key changed without a server restart?
> Is replacing the server.crt/server.key files enough
> or is there more to it?

You need to issue a reload, for example using SIGHUP. That is supported
since PostgreSQL 10.

> And will existing connections continue to use the old
> key until they disconnect?

yes

--
Peter Eisentraut http://www.2ndQuadrant.com/
PostgreSQL Development, 24x7 Support, Remote DBA, Training & Services