Parameter · Connections and Authentication / SSL
ssl_crl_dir
Location of the SSL certificate revocation list directory.
- Default:
'' (empty) - Type: string
- Applies: Reload
In plain words
Like ssl_crl_file, but a directory of revocation lists. New lists dropped into the directory are used for the next connection, without a reload.
For DBAs and operators
Added in PostgreSQL 14. Relative paths are relative to the data directory. The directory must be prepared with openssl rehash (or c_rehash), which creates the hash-named links OpenSSL uses for lookup (<hash>.r0). CRLs are looked up on demand during each handshake, so updates take effect immediately; with ssl_crl_file a reload is needed. Both settings may be used together.
Forgetting to rehash after adding a file is the common reason "the CRL is ignored". As with any CRL, an expired list makes OpenSSL reject every certificate of that CA.
How to change it
Change in postgresql.conf or ALTER SYSTEM, then run SELECT pg_reload_conf().