ssl_key_file

Definition PG 18 manual

Specifies the name of the file containing the SSL server private key. Relative paths are relative to the data directory. This parameter can only be set in the postgresql.conf file or on the server command line. The default is server.key.

How it works

ssl_key_file identifies the location of the SSL server private key file. The file contains the private key matching ssl_cert_file; PostgreSQL enforces restrictive ownership and permissions before accepting it.

ssl_key_file is a SIGHUP-context setting: a configuration reload activates the new server value without a restart; subsequent operations that consult it use the refreshed value. Existing TLS sessions are not renegotiated.

It participates in the TLS context used for new handshakes. ssl enables transport, pg_hba.conf decides which connection classes require it, and the certificate, key, CA, revocation, protocol, and cipher settings must form one valid policy.

Operational considerations

Editing ssl_key_file without reloading configuration and verifying the effective value and subsequent behavior.

Updating only one TLS file or policy knob and leaving an invalid chain, unreadable key, or incompatible protocol set.

Assuming a reload renegotiates existing sessions; TLS policy changes affect new handshakes.

Installing a private key with ownership or permissions that PostgreSQL rejects, or leaking it to a readable group.

Workload guidance

OLAP: Use the same private-key controls for analytical nodes; workload type never justifies a shared, group-writable, or copied key outside the managed PKI process.

OLTP: Keep ssl_key_file owned by the PostgreSQL service account with PostgreSQL-accepted restrictive permissions, ensure it matches ssl_cert_file, and rotate it through an audited secret-delivery path.

SMALL: Prefer one managed key with expiry/renewal tests and protected backups. If it is encrypted, test ssl_passphrase_command and reload behavior before an unattended restart.