Ray Stell wrote:
> On Mon, Nov 01, 2010 at 12:46:33PM -0400, Tom Lane wrote:
> > Ray Stell writes:
> > > Someone asked about ssl client cert auth recently. I got
> > > this to work, but something tripped me up.
> >
> > > http://developer.postgresql.org/pgdocs/postgres/ssl-tcp.html
> >
> > > states (very clearly, btw) that, "To require the client to supply a
> > > trusted certificate, place certificates of the certificate authorities
> > > (CAs) you trust in the file root.crt in the data directory." I had
> > > ASS-U-MEd that root.crt would go in .postgresql as it does for encryption.
> >
> > > This begs the question, why two copies of the same file?
> >
> > The one in ~/.postgresql is for client usage. The one in $PGDATA is for
> > the server's use. There's no reason to assume they'd be the same.
> >
> > regards, tom lane
>
> I think I see where I went off:
> 31.17. SSL Support
> Changing this to:
> 31.17. Client SSL Support
> would be helpful. Also,
> 31.17.4. SSL File Usage
> might be:
> 31.17.4. SSL Client File Usage
> They did this in the server section, so I'm not completely nuts:
> 17.8.2. SSL Server File Usage
>
> In hindsight it is very clear. Chapter 17 is on the server and 31 is on the
> client. Adding those section title words would have helped me stay on
> course.
>
> Another way of providing clue would be to add $PGDATA somewhere in Table
> 17-3. SSL Server File Usage. They did that sort of thing on the client side
> in Table 31-4. Libpq/Client SSL File Usage.
These are all very good ideas and I have applied them for 9.1 in the
attached patch. I also found a few libpq titles that needed
capitalization, which is also in the patch. Thanks for the ideas.
--
Bruce Momjian http://momjian.us
EnterpriseDB http://enterprisedb.com
+ It's impossible for everything to be true. +
diff --git a/doc/src/sgml/libpq.sgml b/doc/src/sgml/libpq.sgml
index fe661b8..1606a56 100644
*** /tmp/pgdiff.4616/aPwGCb_libpq.sgml Mon Jan 17 21:29:06 2011
--- doc/src/sgml/libpq.sgml Mon Jan 17 21:04:29 2011
*** ldap://ldap.acme.com/cn=dbserver,cn=host
*** 6641,6647
! Certificate verification
By default, PostgreSQL will not perform any verification of
--- 6641,6647
! Client Verification of Server Certificates
By default, PostgreSQL will not perform any verification of
*** ldap://ldap.acme.com/cn=dbserver,cn=host
*** 6696,6702
! Client certificates
If the server requests a trusted client certificate,
--- 6696,6702
! Client Certificates
If the server requests a trusted client certificate,
*** ldap://ldap.acme.com/cn=dbserver,cn=host
*** 6738,6744
! Protection provided in different modes
The different values for the sslmode parameter provide different
--- 6738,6744
! Protection Provided in Different Modes
The different values for the sslmode parameter provide different
*** ldap://ldap.acme.com/cn=dbserver,cn=host
*** 6746,6752
protection against three types of attacks:
!SSL attacks
--- 6746,6752
protection against three types of attacks:
!SSL Attacks
*** ldap://ldap.acme.com/cn=dbserver,cn=host
*** 6821,6827
!SSL mode descriptions
--- 6821,6827
!SSL Mode Descriptions
*** ldap://ldap.acme.com/cn=dbserver,cn=host
*** 6912,6918
! SSL File Usage
Libpq/Client SSL File Usage
--- 6912,6918
! SSL Client File Usage
Libpq/Client SSL File Usage
*** ldap://ldap.acme.com/cn=dbserver,cn=host
*** 6958,6964
! SSL library initialization
If your application initializes libssl and/or
--- 6958,6964
! SSL Library Initialization
If your application initializes libssl and/or
diff --git a/doc/src/sgml/runtime.sgml b/doc/src/sgml/runtime.sgml
index 8911e99..9b92bec 100644
*** /tmp/pgdiff.4616/QgCZ3a_runtime.sgml Mon Jan 17 21:29:06 2011
--- doc/src/sgml/runtime.sgml Mon Jan 17 21:18:42 2011
*** $ kill -INT `head -1 /usr/loc
*** 1770,1796
! server.crt
server certificate
sent to client to indicate server's identity
! server.key
server private key
proves server certificate was sent by the owner; does not indicate
certificate owner is trustworthy
! root.crt
trusted certificate authorities
checks that client certificate is
signed by a trusted certificate authority
! root.crl
certificates revoked by certificate author
