> On Apr 12, 2018, at 7:29 PM, Ian R. Bennett <[email protected]> wrote:
>
>> I am needing to replace the certificate and key. Are they read and
>> cached when postfix starts, or are they read during normal mail
>> handling? In other words, can I replace the files or do I need to do
>> a reload or restart of the service afterwards?
>
> You'll need to restart postfix.
That's false. Each smtpd(8) process handles a limited number of
connections ($max_use, default 100) and exits. It also exits when
idle for sufficiently long ($max_idle, default 100s).
Since each smtpd(8) process reads the certificates for itself, unless
the cert/key rotation is extremely urgent (the current cert is
expired and causes problems, i.e. key rotation is too already too
late) there no need for a restart.
And even when the key rotation is urgent "postfix reload" is sufficient,
you don't need to restart. This allows existing connections to finish
gracefully.
--
--
Viktor.
