Protecting an existing key

TDE normally protects the data encryption key (pg_encryption/key.bin) as you initialize the cluster, but you can choose to disable key wrapping, leaving the key unprotected, for example, for testing or demo purposes. If you disabled key wrapping and now want to protect the key, update the encryption settings in the postgresql.conf file, as shown in this example.

Enable key wrapping with a passphrase

This example shows you how to add a passphrase-based protection mechanism or key wrapping to your data encryption key (key.bin).

1. Store the passphrase in a file accessible by initdb named pass.bin:

   Important

   This example stores the passphrase in plaintext, a method you should only use for testing or demonstration purposes. In production environments, don't store your passphrase in a file. See Using a passphrase for alternative methods.

   → WrapCopy

   echo "<passphrase>" > /var/lib/postgresql/pass.bin

2. Use OpenSSL to encrypt the existing key.bin data encryption key with the stored passphrase and save the encrypted file as key.bin.WRAP:

   → WrapCopy

   cat $PGDATA/pg_encryption/key.bin | openssl enc -e -aes-128-cbc -pbkdf2 -pass file:/var/lib/postgresql/pass.bin -out $PGDATA/pg_encryption/key.bin.WRAP

3. Create a backup of the unwrapped data encryption key named key.bin.NOWRAP in case you need to roll back to the original configuration:

   → WrapCopy

   cp $PGDATA/pg_encryption/key.bin $PGDATA/pg_encryption/key.bin.NOWRAP

4. Replace the existing data encryption key with the wrapped version:

   → WrapCopy

   cp $PGDATA/pg_encryption/key.bin.WRAP $PGDATA/pg_encryption/key.bin

5. Create a backup of the existing configuration file named postgresql.conf.NOWRAP in case you need to roll back to the original configuration:

   → WrapCopy

   cp $PGDATA/postgresql.conf $PGDATA/postgresql.conf.NOWRAP

6. Modify the data_encryption_key_unwrap_command value of the postgresql.conf file with the new command:

   → WrapCopy

   sed -i "s|data_encryption_key_unwrap_command.*|data_encryption_key_unwrap_command = 'openssl enc -d -aes-128-cbc -pbkdf2 -pass file:/var/lib/postgresql/pass.bin -in \"%p\"'|" $PGDATA/postgresql.conf

7. Create a backup of the modified postgresql.conf file that includes the key wrapping named postgresql.conf.WRAP:

   → WrapCopy

   cp $PGDATA/postgresql.conf $PGDATA/postgresql.conf.WRAP

8. Restart your database cluster to populate the updated data encryption key configuration:

   → WrapCopy

   pg_ctl start

9. Confirm the cluster starts successfully and the new key wrapping configuration works, then remove the rollback backups. key.bin.NOWRAP is a plaintext copy of your data encryption key, so leaving it on disk defeats the purpose of wrapping the key:

   → WrapCopy

   rm $PGDATA/pg_encryption/key.bin.NOWRAP $PGDATA/postgresql.conf.NOWRAP