Parameter · Connections and Authentication / SSL
ssl_passphrase_command
Command to obtain passphrases for SSL. An empty string means use the built-in prompting mechanism.
- Default:
'' (empty) - Type: string
- Applies: Reload
In plain words
If the server's private key file is protected with a passphrase, PostgreSQL needs that passphrase to read it. This command is run to obtain it, for example by reading it from a secrets store. Empty means PostgreSQL asks on the terminal, which only works when started by hand.
For DBAs and operators
The command must print the passphrase on stdout and exit 0; %p is replaced by a prompt string (use %% for a literal %). Example:
ssl_passphrase_command = '/usr/local/bin/get-pg-key-pass.sh "%p"'It runs as the server OS user when SSL files are loaded at startup, and on reload only if ssl_passphrase_command_supports_reload = on. With an encrypted key and no command, a server started by systemd has no terminal; startup then fails to load the key (could not load private key file "server.key": …), and a reload skips SSL reconfiguration.
Keep the script and anything it reads protected as carefully as an unencrypted key would be; an encrypted key whose passphrase sits in a world-readable file gains nothing. Many sites simply use an unencrypted key with mode 0600.
How to change it
Change in postgresql.conf or ALTER SYSTEM, then run SELECT pg_reload_conf().