# ssl_passphrase_command_supports_reload

> ssl_passphrase_command_supports_reload is the PostgreSQL setting that controls whether "ssl_passphrase_command" is called during server reload.
---

> [!NOTE]
> **Fact — official short description:** “Controls whether "ssl_passphrase_command" is called during server reload.”

## Identity {#identity}

| Field | Value | Meaning |
| --- | --- | --- |
| Type | `bool` | Upstream pg_settings type |
| Context | `sighup` | Takes effect after configuration reload |
| Unit | — | Raw unit |
| Range | — | Raw limits in the last observed version |
| Enum values | — | — for non-enum types |
| Category | Connections and Authentication / SSL | Upstream classification |
| Latest boot value | `off` | off |
{.fields meta="-"}

## Lifecycle {#lifecycle}

| Fact | Value |
| --- | --- |
| First observed | PG11 |
| Present in | PG11–19 Beta 3 |
| Removed in | No |
| Introduction commit | [`8a3d9425290f`](https://git.postgresql.org/gitweb/?p=postgresql.git;a=commit;h=8a3d9425290ff5f6434990349886afae9e1c6008) — Add ssl_passphrase_command setting |
| Commit date | 2018-02-26 |
| Discussion | — |

## Default history {#default-history}

| Versions | Raw `boot_val` | Unit | Human value |
| --- | --- | --- | --- |
| PG11–19 Beta 3 | `off` | — | off |
{.full-width caption="Measured PG9.0–19 Beta 3 boot defaults"}

## How it works {#mechanism}

ssl_passphrase_command_supports_reload decides whether ssl_passphrase_command may be invoked during configuration reload when a replacement SSL key needs a passphrase. When it is off, the command is ignored during reload and PostgreSQL does not reload the SSL configuration if a passphrase is required.

The setting has SIGHUP context and affects replacement TLS material used by new handshakes; existing TLS sessions are not renegotiated. It should be on only when the helper is noninteractive, reliably available, and safe to invoke in the running server environment.

On Windows this setting must be on, because the Windows process model causes every connection to perform a configuration reload. That platform requirement overrides the usual Unix-oriented choice to keep a TTY-dependent helper startup-only.

## Tuning advice {#tuning-advice}

> [!TIP]
> **Advice.** These are workload-specific starting points and must be validated with measurements.

| Workload | Guidance |
| --- | --- |
| OLTP | Enable this only after ssl_passphrase_command is proven noninteractive, idempotent, fast, and available during reload; otherwise a certificate refresh can fail operationally. |
| OLAP | Use the same reload capability across workload classes so certificate rotation behavior is predictable on every node. |
| Small nodes | On Windows this setting must be on. On Unix, leave it off only when reload-time passphrase retrieval is unnecessary; if unattended rotation is required, enable it after testing the helper in the server environment. |
{.full-width}

## Pigsty {#pigsty}

Values use the fixed 8-vCPU, 32-GiB, 100-GiB SSD fixture and render the current Pigsty templates for PG19 Beta 3; this does not assert current Pigsty support for that historical or beta release.

| Template | Effective value | Versus upstream boot | Source expression |
| --- | --- | --- | --- |
| OLTP | Unmodified | — | — |
| OLAP | Unmodified | — | — |
| CRIT | Unmodified | — | — |
| TINY | Unmodified | — | — |
{.full-width}

> [!CAUTION]
> **Advice — pending human review.** Fact from the current Pigsty template projection: OLTP: PG11–19 Beta 3 unmodified; OLAP: PG11–19 Beta 3 unmodified; CRIT: PG11–19 Beta 3 unmodified; TINY: PG11–19 Beta 3 unmodified. No Pigsty-specific rationale is inferred from an absent override.

## Common pitfalls {#common-pitfalls}

- Setting it to off on Windows, where PostgreSQL requires it to be on because each connection performs a configuration reload.
- Enabling reload support while the passphrase helper is interactive, slow, unavailable, or unsafe to invoke repeatedly.
- Assuming a reload renegotiates existing sessions; replacement TLS material affects new handshakes only.
- Failing to inspect server logs after reload; if passphrase retrieval fails, PostgreSQL keeps the previous SSL configuration.

## Related parameters {#related-parameters}

[`ssl`](/parameters/ssl/) · [`ssl_cert_file`](/parameters/ssl-cert-file/) · [`ssl_key_file`](/parameters/ssl-key-file/) · [`ssl_ca_file`](/parameters/ssl-ca-file/) · [`ssl_crl_file`](/parameters/ssl-crl-file/) · [`ssl_min_protocol_version`](/parameters/ssl-min-protocol-version/)

## References {#references}

- [PostgreSQL 19 Beta 3 — ssl_passphrase_command_supports_reload](https://www.postgresql.org/docs/19/runtime-config-connection.html#GUC-SSL-PASSPHRASE-COMMAND-SUPPORTS-RELOAD)
- [PostgreSQL 19 release notes](https://www.postgresql.org/docs/19/release-19.html)
- [Machine-readable GUC export](/data/guc.jsonl)