From: Mark Williams <markwillimas@gmail.com>
To: 'Bear Giles' <bgiles@coyotesong.com>
Cc: pgsql-admin@lists.postgresql.org
Subject: RE: Setting up SSL for postgre
Date: Mon, 13 Aug 2018 20:57:10 +0100
Message-ID: <034901d4333f$d2aa7650$77ff62f0$@gmail.com> (raw)
In-Reply-To: <CALBNtw6-BnnA9AGpaTfSecSnjppLApaKTsYJ664HtfzBt14nRg@mail.gmail.com>
References: <032401d43326$6c275d80$44761880$@gmail.com>
<CALBNtw6-BnnA9AGpaTfSecSnjppLApaKTsYJ664HtfzBt14nRg@mail.gmail.com>
What do you mean by “change the ssl cert file and key”
Pg_hba.conf
# TYPE DATABASE USER CIDR-ADDRESS METHOD
# IPv4 local & remote connections:
host all all 127.0.0.1/32 trust
hostssl all www-data 0.0.0.0/0 md5 clientcert=1
hostssl all postgres 0.0.0.0/0 md5 clientcert=1
# IPv6 local connections:
host all all ::1/128 trust
Postgresql.conf
ssl = on
#ssl_ciphers = 'HIGH:MEDIUM:+3DES:!aNULL' # allowed SSL ciphers
#ssl_prefer_server_ciphers = on
#ssl_ecdh_curve = 'prime256v1'
#ssl_dh_params_file = ''
ssl_cert_file = 'server.crt'
ssl_key_file = 'server.key'
ssl_ca_file = 'root.crt'
#ssl_crl_file = ''
Thanks
__
From: Bear Giles <bgiles@coyotesong.com>
Sent: 13 August 2018 20:01
To: Mark Williams <markwillimas@gmail.com>
Cc: pgsql-admin@lists.postgresql.org
Subject: Re: Setting up SSL for postgre
What's in pg_hba.conf?
What's in postgresql.conf? Did you remember to change the ssl cert file and key? For authentication I think you might need to set the SSL ca file as well but I'm not sure.
On Mon, Aug 13, 2018 at 10:55 AM, Mark Williams <markwillimas@gmail.com <mailto:markwillimas@gmail.com> > wrote:
I am new to Postgre. Migrating from MySQL.
I am trying to connect via SSL to a PostgreSQL using FireDac in Delphi. I have followed the instructions at the following site: <https://www.howtoforge.com/postgresql-ssl-certificates; https://www.howtoforge.com/postgresql-ssl-certificates to create my self-certified certificates and configure the config files.
I have coped the specified files to the client machine and installed the root.crt certificate.
Via FireDAC's connection params I have specified the following:
Params.values[SSL_ca']:=sslCertsPath+'root.crt';
Params.values['SSL_cert']:=sslCertsPath+'postgresql.crt.';
Params.values['SSL_key']:=sslCertsPath+'postgresql.key';
I am getting a connection error re invalid client certificate.
I have used OpenSSL to verify against the root.crt and postgresql.crt and this confirms the certificate is ok.
Mark
__
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-admin@postgresql.org
Cc: markwillimas@gmail.com, bgiles@coyotesong.com, pgsql-admin@lists.postgresql.org
Subject: RE: Setting up SSL for postgre
In-Reply-To: <034901d4333f$d2aa7650$77ff62f0$@gmail.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox