#valid-until

VALID UNTIL password expiry versus client-certificate expiry for PostgreSQL role credentials

Goal I want to choose a single credential‑expiry mechanism for application roles that follows least‑privilege principles, so that expiry behaves predictably and cannot be sidestepped by other authentication methods. Constraints and uncertainty PostgreSQL’s VALID UNTIL timestamp only blocks password‑based logins; it is ignored for cert , peer , trust and simi