On Thu, Sep 23, 2004 at 04:37:52PM -0400, Tom Lane wrote:
> Dominic Mitchell <[EMAIL PROTECTED]> writes:
> > + If verification of client certificates is required, place the
> > + certificates of the <acronym>CA</acronym> you wish to check for in
> > + the file <filename>root.crt</filename> in the data directory. When
> > + present, a client certificate will be requested from the client
> > + making the connection and it must have been signed by one of the
> > + certificates present in <filename>root.crt</filename>. If no
> > + certificate is presented, the connection will be allowed to proceed
> > + anway.
>
> That last statement is not actually correct, is it? AFAICS we do tell
> SSL to enforce certificates if we find a valid root.crt file.
Nope, the code says "ask the client to give me a certificate, but carry
on anyway if you don't get one". The call to SSL_CTX_set_verify in
be-secure.c/initialize_SSL() specifies SSL_VERIFY_PEER |
SSL_VERIFY_CLIENT_ONCE. According to the docs[1], you also need
SSL_VERIFY_FAIL_IF_NO_PEER_CERT if you want requests that do not send a
certificate to be rejected. That terminates the connection immediately.
I've no idea what that would do to the server's state at that point.
More to the point, I can definitely connect in this mode:
% ls -l ~/.postgresql
total 0
% sudo ls -l ~pgsql/data
Password:
total 36
-rw------- 1 pgsql pgsql 4 Dec 5 2003 PG_VERSION
drwx------ 10 pgsql pgsql 512 Sep 17 22:42 base
drwx------ 2 pgsql pgsql 512 Sep 23 22:10 global
drwx------ 2 pgsql pgsql 512 Dec 5 2003 pg_clog
-r--r--r-- 1 pgsql pgsql 3480 Sep 16 21:28 pg_hba.conf
-rw------- 1 pgsql pgsql 1441 Dec 5 2003 pg_ident.conf
drwx------ 2 pgsql pgsql 512 Sep 21 04:09 pg_xlog
-r--r--r-- 1 pgsql pgsql 8033 Sep 21 23:37 postgresql.conf
-rw------- 1 pgsql pgsql 26 Sep 22 07:38 postmaster.opts
-rw------- 1 pgsql pgsql 48 Sep 23 06:01 postmaster.pid
-rw-r--r-- 1 pgsql pgsql 1204 Sep 16 21:30 root.crt
-rw-r--r-- 1 pgsql pgsql 3469 Sep 16 21:24 server.crt
-r-------- 1 pgsql pgsql 887 Sep 16 21:24 server.key
% psql -h db.happygiraffe.net
Welcome to psql 7.4.5, the PostgreSQL interactive terminal.
Type: \copyright for distribution terms
\h for help with SQL commands
\? for help on internal slash commands
\g or terminate with semicolon to execute query
\q to quit
SSL connection (cipher: DHE-RSA-AES256-SHA, bits: 256)
dom=#
-Dom
[1] http://www.openssl.org/docs/ssl/SSL_CTX_set_verify.html
---------------------------(end of broadcast)---------------------------
TIP 4: Don't 'kill -9' the postmaster
