> On Apr 12, 2018, at 7:29 PM, Ian R. Bennett <i...@maleficarum.org> wrote:
>> I am needing to replace the certificate and key.  Are they read and
>> cached when postfix starts, or are they read during normal mail
>> handling?  In other words, can I replace the files or do I need to do
>> a reload or restart of the service afterwards?
> You'll need to restart postfix.

That's false.  Each smtpd(8) process handles a limited number of
connections ($max_use, default 100) and exits.  It also exits when
idle for sufficiently long ($max_idle, default 100s).

Since each smtpd(8) process reads the certificates for itself, unless
the cert/key rotation is extremely urgent (the current cert is
expired and causes problems, i.e. key rotation is too already too
late) there no need for a restart.

And even when the key rotation is urgent "postfix reload" is sufficient,
you don't need to restart.  This allows existing connections to finish


Reply via email to