ssl_cert_file

Definition PG 18 manual

Specifies the name of the file containing the SSL server certificate. Relative paths are relative to the data directory. This parameter can only be set in the postgresql.conf file or on the server command line. The default is server.crt.

How it works

ssl_cert_file identifies the location of the SSL server certificate file. The PEM file supplies the server leaf certificate and may include intermediate certificates needed to present a complete chain to clients.

ssl_cert_file is a SIGHUP-context setting: a configuration reload activates the new server value without a restart; subsequent operations that consult it use the refreshed value. Existing TLS sessions are not renegotiated.

It participates in the TLS context used for new handshakes. ssl enables transport, pg_hba.conf decides which connection classes require it, and the certificate, key, CA, revocation, protocol, and cipher settings must form one valid policy.

Operational considerations

Editing ssl_cert_file without reloading configuration and verifying the effective value and subsequent behavior.

Updating only one TLS file or policy knob and leaving an invalid chain, unreadable key, or incompatible protocol set.

Assuming a reload renegotiates existing sessions; TLS policy changes affect new handshakes.

Changing ssl_cert_file globally without a rollback plan and a client or operational compatibility test.

Workload guidance

OLAP: Analytical endpoints need the same identity guarantees; if they use a separate name, issue the correct SAN rather than reusing a mismatched certificate.

OLTP: Deploy a certificate whose key usage, SANs, validity, and chain match every advertised database endpoint. Test reload and a fresh client handshake before removing the previous certificate.

SMALL: Automate renewal and expiry alerts. A small node gains nothing from a shorter chain if clients cannot build trust; keep only the necessary leaf and intermediates.