Parameter · Connections and Authentication / SSL
ssl_passphrase_command_supports_reload
Controls whether "ssl_passphrase_command" is called during server reload.
- Default:
off - Type: bool
- Applies: Reload
In plain words
Normally the passphrase command runs only at server start. Turn this on if the command can run unattended (reads a file or vault), so that a reload can pick up a new certificate and encrypted key.
For DBAs and operators
Off by default because the command might need a terminal, which does not exist during a reload. When off and the key needs a passphrase, a reload keeps the old SSL configuration and logs that it could not reload it; only a restart applies new key files. Must be on for Windows, where each connection reloads the SSL configuration. Turn it on whenever ssl_passphrase_command is non-interactive; then certificate rotation is "replace files, pg_reload_conf()".
How to change it
Change in postgresql.conf or ALTER SYSTEM, then run SELECT pg_reload_conf().