Re: [HACKERS] Gracefully Reload SSL Certificates

2015-04-08 Thread Bruce Momjian
On Wed, Apr 8, 2015 at 11:48:11AM -0400, Donald Stufft wrote: > Currently replacing the SSL certificates for PostgreSQL requires a full server > restart. However in the infrastructure for www.python.org (and in the future, > pypi.python.org as well) we use short lived certificates (1 day) that > a

[HACKERS] Gracefully Reload SSL Certificates

2015-04-08 Thread Donald Stufft
Currently replacing the SSL certificates for PostgreSQL requires a full server restart. However in the infrastructure for www.python.org (and in the future, pypi.python.org as well) we use short lived certificates (1 day) that automatically get rotated when 75% of their lifetime is used up. This me