On 12/02/2013 02:45 PM, Bruce Momjian wrote:
On Mon, Dec 2, 2013 at 12:59:41PM -0500, Tom Lane wrote:
Bruce Momjian <br...@momjian.us> writes:
I have updated the patch, attached, to be clearer about the requirement
that intermediate certificates need a chain to root certificates.
I see that you removed the sentence
The root
certificate should be included in every case where
<filename>postgresql.crt</> contains more than one certificate.
in both places where it appeared. I seem to remember that I'd put that
in on the basis of experimentation, ie it didn't work to provide just
a partial chain. You appear to be telling people that it's safe to
omit the root cert, and I think this is wrong.
Specifically, rather than the text "trusted by the server, i.e. signed by
a certificate in the server's <filename>root.crt</filename> file", I think
you need to say "trusted by the server, i.e., appears in the server's
<filename>root.crt</filename> file". Have you experimented with the
configuration you're proposing, and if so, with which OpenSSL versions?
I am basing the text on the tests done in this thread, though I can test
it myself too (though I have not yet). This email indicates we only
need the client cert in the client, not the chain to root:
http://www.postgresql.org/message-id/5146a103.8080...@2ndquadrant.com
OK, we're good now, the server is sending us the intermediate cert we
require. Regular non-client-cert verified SSL is fine. Examination of
the protocol chat shows that the server is sending a Server Hello with a
Certificate message containing the server and intermdediate certificate
DNs:
It can get the root and intermediate from the server, hence the "signed
by" rather than "appears" wording. This text indicates also that the
client doesn't have to have the certificate chain to the root:
http://www.postgresql.org/message-id/514a9ddf.3050...@2ndquadrant.com
Drat, you're quite right. I've always included the full certificate
chain in client certs but it's in no way required.
I don't fully understand the issues but the discussion seens to indicate
this. Am I missing something? Should I run some tests?
AIUI, you need a complete chain from one end to the other. So the cert
being checked can include the intermediate cert in what it sends, or it
can be in the root.crt at the other end, but one way or another, the
checking end needs a complete chain from a root cert to the cert from
the other end.
cheers
andrew
--
Sent via pgsql-hackers mailing list (pgsql-hackers@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-hackers
