</para>

<para>

If the private key is protected with a passphrase, the

server will prompt for the passphrase and will not start until it has

been entered.

The private key cannot be protected with a passphrase, as there is no

way to supply the passphrase to the server.

</para>

<para>

you enter the local host name as <quote>Common Name</>; the challenge

password can be left blank. The program will generate a key that is

passphrase protected; it will not accept a passphrase that is less

than four characters long. To remove the passphrase (as you must if

you want automatic start-up of the server), run the commands:

than four characters long.To remove the passphraseagain(as you must),

next run the commands:

<programlisting>

openssl rsa -in privkey.pem -out server.key

rm privkey.pem

staticDH*load_dh_buffer(constchar*,size_t);

staticDH*generate_dh_parameters(intprime_len,intgenerator);

staticDH*tmp_dh_cb(SSL*s,intis_export,intkeylength);

staticintssl_passwd_cb(char*buf,intsize,intrwflag,void*userdata);

staticintverify_cb(int,X509_STORE_CTX*);

staticvoidinfo_cb(constSSL*ssl,inttype,intargs);

staticboolinitialize_ecdh(SSL_CTX*context,boolfailOnError);

SSL_CTX_set_mode(context,SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER);

SSL_CTX_set_default_passwd_cb(context,ssl_passwd_cb);

returnr;

}

ssl_passwd_cb(char*buf,intsize,intrwflag,void*userdata)

{

ereport(LOG,

(errcode(ERRCODE_CONFIG_FILE_ERROR),

errmsg("server's private key file requires a passphrase")));

Assert(size>0);

buf[0]='\0';

return0;

}