Parameter · Connections and Authentication / SSL
ssl_key_file
Location of the SSL server private key file.
- Default:
server.key - Type: string
- Applies: Reload
In plain words
The secret key that belongs to the server certificate. Whoever has it can impersonate the server, so it must be readable only by the PostgreSQL OS user.
For DBAs and operators
Relative paths are relative to the data directory. Permission checks at load time: the file must be owned by the server user with mode 0600 or less, or owned by root with mode 0640 or less. Otherwise: FATAL: private key file "server.key" has group or world access with DETAIL: File must have permissions u=rw (0600) or less if owned by the database user, or permissions u=rw,g=r (0640) or less if owned by root.
An encrypted (passphrase-protected) key needs ssl_passphrase_command; without it the server prompts on the terminal at startup, which does not work under systemd, and a reload cannot re-read it unless ssl_passphrase_command_supports_reload is on.
When renewing certificates, replace key and certificate together, then reload: a key that does not match the certificate is refused with key values mismatch.
How to change it
Change in postgresql.conf or ALTER SYSTEM, then run SELECT pg_reload_conf().