ssl_passphrase_command_supports_reload

Definition PG 18 manual

This parameter determines whether the passphrase command set by ssl_passphrase_command will also be called during a configuration reload if a key file needs a passphrase. If this parameter is off (the default), then ssl_passphrase_command will be ignored during a reload and the SSL configuration will not be reloaded if a passphrase is needed. That setting is appropriate for a command that requires a TTY for prompting, which might not be available when the server is running. Setting this parameter to on might be appropriate if the passphrase is obtained from a file, for example.

This parameter must be set to on when running on Windows since all connections will perform a configuration reload due to the different process model of that platform.

This parameter can only be set in the postgresql.conf file or on the server command line.

How it works

ssl_passphrase_command_supports_reload decides whether ssl_passphrase_command may be invoked during configuration reload when a replacement SSL key needs a passphrase. When it is off, the command is ignored during reload and PostgreSQL does not reload the SSL configuration if a passphrase is required.

The setting has SIGHUP context and affects replacement TLS material used by new handshakes; existing TLS sessions are not renegotiated. It should be on only when the helper is noninteractive, reliably available, and safe to invoke in the running server environment.

On Windows this setting must be on, because the Windows process model causes every connection to perform a configuration reload. That platform requirement overrides the usual Unix-oriented choice to keep a TTY-dependent helper startup-only.

Operational considerations

Setting it to off on Windows, where PostgreSQL requires it to be on because each connection performs a configuration reload.

Enabling reload support while the passphrase helper is interactive, slow, unavailable, or unsafe to invoke repeatedly.

Assuming a reload renegotiates existing sessions; replacement TLS material affects new handshakes only.

Failing to inspect server logs after reload; if passphrase retrieval fails, PostgreSQL keeps the previous SSL configuration.

Workload guidance

OLAP: Use the same reload capability across workload classes so certificate rotation behavior is predictable on every node.

OLTP: Enable this only after ssl_passphrase_command is proven noninteractive, idempotent, fast, and available during reload; otherwise a certificate refresh can fail operationally.

SMALL: On Windows this setting must be on. On Unix, leave it off only when reload-time passphrase retrieval is unnecessary; if unattended rotation is required, enable it after testing the helper in the server environment.