<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<span style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">Thanks for the quick response, Tatsuo.</span>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
>From the docs my assumption was that a full restart is only needed if the filename of the CRL needs to change, but it's useful to know that it's required even if the contents of the file itself changes.</div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
In case it is of interest - PostgreSQL's ssl_crl_dir allows for changes while the server is running (and for ssl_crl_file a reload is sufficient):</div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<dt><code>ssl_crl_dir</code> (<code>string</code>)</dt><dd>
<p>Specifies the name of the directory containing the SSL client certificate revocation list (CRL). Relative paths are relative to the data directory. This parameter can only be set in the
<code>postgresql.conf</code> file or on the server command line. The default is empty, meaning no CRLs are used (unless
<a href="https://www.postgresql.org/docs/current/runtime-config-connection.html#GUC-SSL-CRL-FILE" id="OWA1579148e-6bf1-1d60-9780-4533ce303dab" class="xref OWAAutoLink" style="margin-top: 0px; margin-bottom: 0px;" data-loopstyle="linkonly">
ssl_crl_file</a> is set).</p>
<p>The directory needs to be prepared with the OpenSSL command <code>openssl rehash</code> or
<code>c_rehash</code>. See its documentation for details.</p>
<p>When using this setting, CRLs in the specified directory are loaded on-demand at connection time. New CRLs can be added to the directory and will be used immediately. This is unlike
<a href="https://www.postgresql.org/docs/current/runtime-config-connection.html#GUC-SSL-CRL-FILE" id="OWA1fffafcc-e76b-f377-29b6-a8fc8c0899d1" class="xref OWAAutoLink" style="margin-top: 0px; margin-bottom: 0px;" data-loopstyle="linkonly">
ssl_crl_file</a>, which causes the CRL in the file to be loaded at server start time or when the configuration is reloaded. Both settings can be used together.</p>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
But at the moment PgPool does not support such a parameter.</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Kind regards</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Ian</div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> Tatsuo Ishii <ishii@sraoss.co.jp><br>
<b>Sent:</b> 07 May 2024 11:25<br>
<b>To:</b> Ian van der Linde <ian@ivdl.co.za><br>
<b>Cc:</b> pgpool-general@pgpool.net <pgpool-general@pgpool.net><br>
<b>Subject:</b> Re: [pgpool-general: 9096] Is the TLS certificate revocation list loaded only on server start, or does the TLS/SSL library reload it on every connection?</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt;">
<div class="PlainText">> Good day<br>
> <br>
> PgPool supports setting an ssl_crl_file parameter to configure a certificate revocation list. Let's assume that's been set up, and PgPool has been restarted to load the file. If the file is changed to revoke another certificate, will that automatically be
picked up by the running PgPool the next time a client connects, or does PgPool need to be restarted every time a certificate is added to the CRL? If so, is a simple configuration reload sufficient, or does it have to be a full restart?<br>
<br>
You need a full restart as mentioned in the docs. Note that<br>
PostgreSQL's ssl_crl_file needs a server restart if it is changed.<br>
<br>
Best reagards,<br>
--<br>
Tatsuo Ishii<br>
SRA OSS LLC<br>
English: <a href="http://www.sraoss.co.jp/index_en/">http://www.sraoss.co.jp/index_en/</a><br>
Japanese:http://www.sraoss.co.jp<br>
</div>
</span></font></div>
</dd></body>
</html>