Parameter · Connections and Authentication / SSL
ssl_crl_file
Location of the SSL certificate revocation list file.
- Default:
'' (empty) - Type: string
- Applies: Reload
In plain words
A list of client certificates that were revoked (for example a stolen laptop's certificate). Clients presenting a revoked certificate are refused. Empty by default.
For DBAs and operators
Relative paths are relative to the data directory. The file is loaded when the server starts and on every reload, so after publishing a new CRL you must SELECT pg_reload_conf();. Only relevant when clients authenticate with certificates (ssl_ca_file set). A revoked client fails the handshake; the server log shows LOG: could not accept SSL connection: certificate verify failed with DETAIL: Client certificate verification failed at depth 0: certificate revoked.
An expired CRL makes OpenSSL reject all certificates from that CA, a classic sudden outage when CRL publishing breaks. Can be combined with ssl_crl_dir (PostgreSQL 14+), which loads CRLs on demand.
How to change it
Change in postgresql.conf or ALTER SYSTEM, then run SELECT pg_reload_conf().