# ssl_crl_file

> ssl_crl_file is the PostgreSQL setting that identifies the location of the SSL certificate revocation list file.
---

> [!NOTE]
> **Fact — official short description:** “Location of the SSL certificate revocation list file.”

## Identity {#identity}

| Field | Value | Meaning |
| --- | --- | --- |
| Type | `string` | Upstream pg_settings type |
| Context | `sighup` | Takes effect after configuration reload |
| Unit | — | Raw unit |
| Range | — | Raw limits in the last observed version |
| Enum values | — | — for non-enum types |
| Category | Connections and Authentication / SSL | Upstream classification |
| Latest boot value | `""` | empty string |
{.fields meta="-"}

## Lifecycle {#lifecycle}

| Fact | Value |
| --- | --- |
| First observed | PG9.2 |
| Present in | PG9.2–19 Beta 3 |
| Removed in | No |
| Introduction commit | [`a445cb92ef5b`](https://git.postgresql.org/gitweb/?p=postgresql.git;a=commit;h=a445cb92ef5b3a31313ebce30e18cc1d6e0bdecb) — Add parameters for controlling locations of server-side SSL files |
| Commit date | 2012-02-22 |
| Discussion | — |

## Default history {#default-history}

| Versions | Raw `boot_val` | Unit | Human value |
| --- | --- | --- | --- |
| PG9.2–19 Beta 3 | `""` | — | empty string |
{.full-width caption="Measured PG9.0–19 Beta 3 boot defaults"}

## How it works {#mechanism}

ssl_crl_file identifies the location of the SSL certificate revocation list file. The PEM revocation list is consulted when validating client certificates and must be refreshed as issuers publish new revocation state.

ssl_crl_file is a SIGHUP-context setting: a configuration reload activates the new server value without a restart; subsequent operations that consult it use the refreshed value. Existing TLS sessions are not renegotiated.

It participates in the TLS context used for new handshakes. ssl enables transport, pg_hba.conf decides which connection classes require it, and the certificate, key, CA, revocation, protocol, and cipher settings must form one valid policy.

## Tuning advice {#tuning-advice}

> [!TIP]
> **Advice.** These are workload-specific starting points and must be validated with measurements.

| Workload | Guidance |
| --- | --- |
| OLTP | Refresh ssl_crl_file from the issuing CA before its next-update deadline, validate its signature and issuer coverage, reload PostgreSQL, and prove that a newly revoked client certificate is rejected. |
| OLAP | Analytical clients follow the same revocation policy; do not defer CRL refresh because their sessions are longer or less frequent. |
| Small nodes | If a managed CRL feed is unavailable, document that client-certificate revocation is not current rather than relying on a stale file. Keep the file and reload process monitored on every failover node. |
{.full-width}

## Pigsty {#pigsty}

Values use the fixed 8-vCPU, 32-GiB, 100-GiB SSD fixture and render the current Pigsty templates for PG19 Beta 3; this does not assert current Pigsty support for that historical or beta release.

| Template | Effective value | Versus upstream boot | Source expression |
| --- | --- | --- | --- |
| OLTP | Unmodified | — | — |
| OLAP | Unmodified | — | — |
| CRIT | Unmodified | — | — |
| TINY | Unmodified | — | — |
{.full-width}

> [!CAUTION]
> **Advice — pending human review.** Fact from the current Pigsty template projection: OLTP: PG9.2–19 Beta 3 unmodified; OLAP: PG9.2–19 Beta 3 unmodified; CRIT: PG9.2–19 Beta 3 unmodified; TINY: PG9.2–19 Beta 3 unmodified. No Pigsty-specific rationale is inferred from an absent override.

## Common pitfalls {#common-pitfalls}

- Editing ssl_crl_file without reloading configuration and verifying the effective value and subsequent behavior.
- Updating only one TLS file or policy knob and leaving an invalid chain, unreadable key, or incompatible protocol set.
- Assuming a reload renegotiates existing sessions; TLS policy changes affect new handshakes.
- Changing ssl_crl_file globally without a rollback plan and a client or operational compatibility test.

## Related parameters {#related-parameters}

[`ssl`](/parameters/ssl/) · [`ssl_cert_file`](/parameters/ssl-cert-file/) · [`ssl_key_file`](/parameters/ssl-key-file/) · [`ssl_ca_file`](/parameters/ssl-ca-file/) · [`ssl_min_protocol_version`](/parameters/ssl-min-protocol-version/)

## References {#references}

- [PostgreSQL 19 Beta 3 — ssl_crl_file](https://www.postgresql.org/docs/19/runtime-config-connection.html#GUC-SSL-CRL-FILE)
- [PostgreSQL 19 release notes](https://www.postgresql.org/docs/19/release-19.html)
- [Machine-readable GUC export](/data/guc.jsonl)