On Mon, Dec 2, 2013 at 03:07:48PM -0500, Tom Lane wrote: > Bruce Momjian <br...@momjian.us> writes: > > On Mon, Dec 2, 2013 at 12:59:41PM -0500, Tom Lane wrote: > >> I see that you removed the sentence > >> The root > >> certificate should be included in every case where > >> <filename>postgresql.crt</> contains more than one certificate. > > > I don't fully understand the issues but the discussion seens to indicate > > this. Am I missing something? Should I run some tests? > > My recollection is that if the client cert file includes *only* the > client's own cert, the server will puzzle out how that connects to the > certs it has. However, if the client cert file contains more than one > cert (ie, client's cert and some intermediate-CA cert), the server > will *not* try to associate the intermediate cert with some root cert it > has. It wants the chain the client sends to terminate in a cert that it > has listed directly in root.crt.
OK, so you are saying if the client only supplies one cert, it will try to find a signing cert in root.crt, but if multiple certs are supplied, you have to get a cert match (not a signing). I can adjust the docs for that. -- Bruce Momjian <br...@momjian.us> http://momjian.us EnterpriseDB http://enterprisedb.com + Everyone has their own god. + -- Sent via pgsql-hackers mailing list (pgsql-hackers@postgresql.org) To make changes to your subscription: http://www.postgresql.org/mailpref/pgsql-hackers
