{"Entry":{"collection":"guc","key":"ssl_passphrase_command","name":"ssl_passphrase_command","aliases":[],"metadata":{"baseline":false,"boot_human":"Not specified","boot_val":null,"category":"Connections and Authentication / SSL","category_zh":"","changed_in":["18"],"changes":[{"documentation_changed":false,"fields":{},"from":"10","status":"added","to":"11"},{"documentation_changed":false,"fields":{"extra_desc":{"from":null,"to":"An empty string means use the built-in prompting mechanism."}},"from":"17","status":"changed","to":"18"}],"content_hash":"cfbb3a651596ac0ead131c1261b3272271e72a9e9907dc0677f5a3793ea962c8","context":"","default_changed_in":[],"default_history":[{"from":"11","to":"19","value":"Empty string"}],"derived_content_hash":"3163317ab2ef11b1dcbb2af2c546596c14a1c9fd7e1212c60b284aa0a3568f8d","editorial":{"advice":{"olap":"Use the identical helper and secret source on analytical nodes; workload class does not change the private-key trust requirement. Test unattended restart before scheduling certificate rotation.","oltp":"Use an absolute-path, minimal, noninteractive helper backed by a protected keychain or file descriptor. Test exact stdout, exit status, %p quoting, timeout/failure, startup, reload, and failover-node availability without logging the passphrase.","small":"Prefer the simplest auditable helper that can restart unattended. If a TTY prompt is retained, document that reload cannot replace an encrypted key unless supports_reload is safely enabled."},"mechanism":["ssl_passphrase_command is an external helper invoked when PostgreSQL must decrypt an SSL file such as an encrypted private key. The helper must write the passphrase to standard output and exit with status zero; PostgreSQL strips one trailing newline from the output.","Within the configured command, %p is replaced by a prompt string that can contain whitespace and therefore must be quoted safely; %% emits a literal percent. The command runs as the PostgreSQL service account, and its environment, path, arguments, output, and error logging must not expose the secret.","It has SIGHUP context, but whether an encrypted key can be replaced during reload also depends on ssl_passphrase_command_supports_reload. A noninteractive keychain/file helper can support reload; a TTY prompt is normally suitable only for controlled startup, and Windows has additional reload requirements."],"pitfalls":["Printing anything except the passphrase to standard output or returning a nonzero status.","Failing to quote %p even though the substituted prompt can contain whitespace, or forgetting that %% is required for a literal percent.","Exposing the passphrase through command arguments, process listings, environment variables, shell tracing, stderr, or server logs.","Deploying a helper that works interactively on one primary but fails during unattended restart, reload, or failover."],"references":[{"title":"PostgreSQL 19 Beta 4: ssl_passphrase_command","url":"https://www.postgresql.org/docs/19/runtime-config-connection.html#GUC-SSL-PASSPHRASE-COMMAND"},{"title":"PostgreSQL 19 release notes","url":"https://www.postgresql.org/docs/19/release-19.html"}],"related":["ssl","ssl_cert_file","ssl_key_file","ssl_ca_file","ssl_crl_file","ssl_min_protocol_version"],"summary":"ssl_passphrase_command is the PostgreSQL setting that defines the command to obtain passphrases for SSL."},"enumvals":[],"first_version":"11","group":"Connections and Authentication","group_slug":"connection","imported_at":"2026-09-27T17:57:32.035601+08:00","intro_commit":{"authored_at":"2018-02-26T13:28:38-05:00","discussion":[],"hash":"8a3d9425290ff5f6434990349886afae9e1c6008","subject":"Add ssl_passphrase_command setting","url":"https://git.postgresql.org/gitweb/?p=postgresql.git;a=commit;h=8a3d9425290ff5f6434990349886afae9e1c6008"},"key":"ssl_passphrase_command","last_version":"20","max_val":"","min_val":"","name":"ssl_passphrase_command","position":378,"present_in":["11","12","13","14","15","16","17","18","19","20"],"repair_provenance":{"original_source_revision":"english-manuals:bd44c2e20528395e9fa104a174e98b8410890f17e3fd7228fd6022e823cfb543","receipt_sha256":"0119916e543c20482e3254a494189137784d6bc0b21171a3e7819144b5acf9f2","repair":"wiki-repair-20261023"},"short_desc":"Sets an external command to be invoked when a passphrase for decrypting an SSL file such as a private key needs to be obtained.","short_desc_zh":"","source_rev":"wiki-repair-20261023:8b42baf302478322147dce2acfc49701200e5e91ce8a15253b93ebc971f7c63f","unit":"","vartype":"string"}},"Definition":{"Collection":"guc","Key":"ssl_passphrase_command","SourceDatabase":"center","Version":"18","SourceTable":"guc","SourceKey":"ssl_passphrase_command","SourceRevision":"wiki-repair-20261023:8b42baf302478322147dce2acfc49701200e5e91ce8a15253b93ebc971f7c63f","Facts":{"boot_val":"","category":"Connections and Authentication / SSL","context":"sighup","description":"Sets an external command to be invoked when a passphrase for decrypting an SSL file such as a private key needs to be obtained. By default, this parameter is empty, which means the built-in prompting mechanism is used. The command must print the passphrase to the standard output and exit with code 0. In the parameter value, %p is replaced by a prompt string. (Write %% for a literal %.) Note that the prompt string will probably contain whitespace, so be sure to quote adequately. A single newline is stripped from the end of the output if present. The command does not actually have to prompt the user for a passphrase. It can read it from a file, obtain it from a keychain facility, or similar. It is up to the user to make sure the chosen mechanism is adequately secure. This parameter can only be set in the postgresql.conf file or on the server command line.","description_zh":"设置获取用于解密私钥等 SSL 文件的口令时要调用的外部命令。默认值为空，表示使用内置的提示机制。 该命令必须将口令输出到标准输出，并以退出码 0 结束。参数值中的 %p 会被替换为提示字符串。（要表示字面值 %，应写成 %%。）提示字符串可能包含空白，因此务必正确加引号。如果输出末尾有一个换行符，会将其去掉。 该命令不一定要提示用户输入口令，也可以从文件读取口令、从钥匙链获取口令等。用户应自行确保所选机制足够安全。 此参数只能在 postgresql.conf 文件中或服务器命令行上设置。","description_zh_html":"\u003cp\u003e\n        设置获取用于解密私钥等 SSL 文件的口令时要调用的外部命令。默认值为空，表示使用内置的提示机制。\n       \u003c/p\u003e\u003cp\u003e\n        该命令必须将口令输出到标准输出，并以退出码 0 结束。参数值中的 \u003ccode class=\"literal\"\u003e%p\u003c/code\u003e 会被替换为提示字符串。（要表示字面值 \u003ccode class=\"literal\"\u003e%\u003c/code\u003e，应写成 \u003ccode class=\"literal\"\u003e%%\u003c/code\u003e。）提示字符串可能包含空白，因此务必正确加引号。如果输出末尾有一个换行符，会将其去掉。\n       \u003c/p\u003e\u003cp\u003e\n        该命令不一定要提示用户输入口令，也可以从文件读取口令、从钥匙链获取口令等。用户应自行确保所选机制足够安全。\n       \u003c/p\u003e\u003cp\u003e\n        此参数只能在 \u003ccode class=\"filename\"\u003epostgresql.conf\u003c/code\u003e 文件中或服务器命令行上设置。\n       \u003c/p\u003e","doc":{"anchor":"GUC-SSL-PASSPHRASE-COMMAND","file":"runtime-config-connection.html","lang":"en","sha256":"567ba928f3e4c4783f548dc8a54f1e748f02bbe163924605f2132eb5b0da440d","slug":"18"},"documented":true,"enumvals":null,"extra_desc":"An empty string means use the built-in prompting mechanism.","lang":"en","max_val":null,"metadata_version":"18","min_val":null,"name":"ssl_passphrase_command","short_desc":"Command to obtain passphrases for SSL.","source":"pg-settings-source-snapshot","translation_provenance":{"inputs":[{"kind":"current-pgdoc-translation","path":"/Users/vonng/pgsty/pgdoc/zh/18/html/runtime-config-connection.html","sha256":"f4e5e4debc927cfa154bbdd71f3bf2eda8130ac3acace1109fe7d45ef2a3456b"}],"kind":"same-version-pgdoc","locale":"zh-Hans","source_revision":"b1b500221dbe5437cfca004d6b04d3f6e422765d","version":"18"},"unit":null,"vartype":"string","zh_from":"same-version-pgdoc"},"ManualEvidence":{"doc":{"anchor":"GUC-SSL-PASSPHRASE-COMMAND","file":"runtime-config-connection.html","lang":"en","sha256":"567ba928f3e4c4783f548dc8a54f1e748f02bbe163924605f2132eb5b0da440d","slug":"18"}},"MeasuredEvidence":{"metadata_version":"18"}},"Text":{"Collection":"guc","Key":"ssl_passphrase_command","SourceDatabase":"center","Version":"18","Locale":"en","Title":"ssl_passphrase_command","Summary":"Sets an external command to be invoked when a passphrase for decrypting an SSL file such as a private key needs to be obtained. By default, this parameter is empty, which means the built-in prompting mechanism is used. The command must print the passphrase to the standard output and exit with code 0. In the parameter value, %p is replaced by a prompt string. (Write %% for a literal %.) Note that the prompt string will probably contain whitespace, so be sure to quote adequately. A single newline is stripped from the end of the output if present. The command does not actually have to prompt the user for a passphrase. It can read it from a file, obtain it from a keychain facility, or similar. It is up to the user to make sure the chosen mechanism is adequately secure. This parameter can only be set in the postgresql.conf file or on the server command line.","BodyHTML":"\u003cp\u003eSets an external command to be invoked when a passphrase for decrypting an SSL file such as a private key needs to be obtained. By default, this parameter is empty, which means the built-in prompting mechanism is used. The command must print the passphrase to the standard output and exit with code 0. In the parameter value, %p is replaced by a prompt string. (Write %% for a literal %.) Note that the prompt string will probably contain whitespace, so be sure to quote adequately. A single newline is stripped from the end of the output if present. The command does not actually have to prompt the user for a passphrase. It can read it from a file, obtain it from a keychain facility, or similar. It is up to the user to make sure the chosen mechanism is adequately secure. This parameter can only be set in the postgresql.conf file or on the server command line.\u003c/p\u003e","SourceRevision":"wiki-repair-20261023:8b42baf302478322147dce2acfc49701200e5e91ce8a15253b93ebc971f7c63f","ContentHash":"63fee2b37ea99d72f17742a5055d4fa480ff0fb8f7af9c6c0228e1b177a8d5b2","Payload":{"description":"Sets an external command to be invoked when a passphrase for decrypting an SSL file such as a private key needs to be obtained. By default, this parameter is empty, which means the built-in prompting mechanism is used. The command must print the passphrase to the standard output and exit with code 0. In the parameter value, %p is replaced by a prompt string. (Write %% for a literal %.) Note that the prompt string will probably contain whitespace, so be sure to quote adequately. A single newline is stripped from the end of the output if present. The command does not actually have to prompt the user for a passphrase. It can read it from a file, obtain it from a keychain facility, or similar. It is up to the user to make sure the chosen mechanism is adequately secure. This parameter can only be set in the postgresql.conf file or on the server command line."}},"RequestedLocale":"en","Fallback":false,"Versions":["11","12","13","14","15","16","17","18","19","20"],"Locales":["en","zh-Hans"],"Signatures":null,"Spellings":null,"SQLState":null,"Evidence":null}