Received: from malur.postgresql.org ([2a02:16a8:dc51::56]) by arkaria.postgresql.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA384:256) (Exim 4.89) (envelope-from ) id 1fsOcP-0001HO-BT for pgsql-admin@arkaria.postgresql.org; Wed, 22 Aug 2018 08:35:57 +0000 Received: from localhost ([127.0.0.1] helo=malur.postgresql.org) by malur.postgresql.org with esmtp (Exim 4.89) (envelope-from ) id 1fsOcN-000355-0h for pgsql-admin@arkaria.postgresql.org; Wed, 22 Aug 2018 08:35:55 +0000 Received: from makus.postgresql.org ([2001:4800:1501:1::229]) by malur.postgresql.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA384:256) (Exim 4.89) (envelope-from ) id 1fsOMP-0001fZ-7M for pgsql-admin@lists.postgresql.org; Wed, 22 Aug 2018 08:19:25 +0000 Received: from asp-lcl-out1.belnet.be ([2001:6a8:3c80::156]) by makus.postgresql.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA384:256) (Exim 4.89) (envelope-from ) id 1fsOMK-0002S7-AE for pgsql-admin@lists.postgresql.org; Wed, 22 Aug 2018 08:19:23 +0000 Received: from BERENS.int.ucll.be (berens.ucll.be [193.190.138.15]) by asp-lcl-out1.belnet.be (8.14.4/8.14.4/Debian-4+deb7u1) with ESMTP id w7M8JD6a026551 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 22 Aug 2018 10:19:14 +0200 Received: from Mistik.int.ucll.be (10.21.7.40) by webmail.ucll.be (193.190.138.15) with Microsoft SMTP Server (TLS) id 15.0.1293.2; Wed, 22 Aug 2018 10:19:13 +0200 Received: from ROLLING.int.ucll.be (10.21.7.30) by Mistik.int.ucll.be (10.21.7.40) with Microsoft SMTP Server (TLS) id 15.0.1293.2; Wed, 22 Aug 2018 10:19:13 +0200 Received: from ROLLING.int.ucll.be ([fe80::f93b:729:9ace:3688]) by ROLLING.int.ucll.be ([fe80::f93b:729:9ace:3688%14]) with mapi id 15.00.1293.006; Wed, 22 Aug 2018 10:19:13 +0200 From: Wim Bertels To: Mark Williams , "pgsql-admin@lists.postgresql.org" , "s.dunand@sirap.fr" Subject: Re: Setting up SSL for postgre Thread-Topic: Setting up SSL for postgre Thread-Index: AQJ64nPKQfAewiPZ9t7gQ7SiT+1fnwIMhi/1AcD6KUcCiXXq5aM+/62ggAmE0jD//+mFgIAAKFbm///2JwCAAtemcA== Date: Wed, 22 Aug 2018 08:19:12 +0000 Message-ID: <1534925952974.49431@ucll.be> References: <032401d43326$6c275d80$44761880$@gmail.com> <034901d4333f$d2aa7650$77ff62f0$@gmail.com> <076401d43883$89ec6830$9dc53890$@gmail.com>,<4ea1e251-0aa2-be17-4405-d1ccec951ecc@sirap.fr> <1534771775784.73685@ucll.be>,<077b01d43895$51aad620$f5008260$@gmail.com> In-Reply-To: <077b01d43895$51aad620$f5008260$@gmail.com> Accept-Language: nl-BE, en-GB, en-US Content-Language: nl-BE X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.16.6.35] Content-Type: multipart/alternative; boundary="_000_153492595297449431ucllbe_" MIME-Version: 1.0 X-Spam-Score: undef - relay 193.190.138.15 marked with skip_spam_scan X-CanIt-Geo: ip=193.190.138.15; country=BE; region=Flanders; city=Leuven; latitude=50.8833; longitude=4.7000; http://maps.google.com/maps?q=50.8833,4.7000&z=6 X-CanItPRO-Stream: ucll-out:out (inherits from ucll-out:default,ucll-in:default,advanced:default,base:default) X-Canit-Stats-ID: Bayes signature not available X-Scanned-By: CanIt (www . roaringpenguin . com) List-Id: List-Help: List-Subscribe: List-Post: List-Owner: List-Archive: Precedence: bulk --_000_153492595297449431ucllbe_ Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Hallo Mark, as i quickly read the error message in your question, these we're my first suggestions. either * did you intent cert aut for the postgres user? * u use a selfsigned certificate, hence software that checks for the validi= ty will fail or ask for this ** using for example the free, but official letsencrypt certificates this s= hould be solved hth, Wim ________________________________ Van: Mark Williams Verzonden: maandag 20 augustus 2018 16:51 Aan: Wim Bertels; pgsql-admin@lists.postgresql.org; s.dunand@sirap.fr Onderwerp: RE: Setting up SSL for postgre Hi, Sorry I don't understand what you are suggesting re the pg_hba file. __ From: Wim Bertels Sent: 20 August 2018 14:30 To: pgsql-admin@lists.postgresql.org; s.dunand@sirap.fr Subject: Re: Setting up SSL for postgre pg_hba.conf # TYPE DATABASE USER CIDR-ADDRESS METHOD # IPv4 local & remote connections: host all all 127.0.0.1/32 trust hostssl all postgres 0.0.0.0/0 cert cert method for auth, hence this behaviour (client cert..) extra tip: https://duckduckgo.com/?q=3Dletsencrypt+postgresql for official server side certificates mvg, Bertels Wim Mark __ This page helped me : https://www.depesz.com/2015/05/11/how-to-setup-ssl-connections-and-authenti= cation/ Best regards, St=E9phane --_000_153492595297449431ucllbe_ Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable

Hallo Mark,


as i quickly read the error message in your question,

these we're my first suggestions.


either

* did you intent cert aut for the postgres user?

* u use a selfsigned certificate, hence software that checks for the val= idity will fail or ask for this

** using for example the free, but official letsencrypt certificates thi= s should be solved


hth,

Wim


Van: Mark Williams <mar= kwillimas@gmail.com>
Verzonden: maandag 20 augustus 2018 16:51
Aan: Wim Bertels; pgsql-admin@lists.postgresql.org; s.dunand@sirap.f= r
Onderwerp: RE: Setting up SSL for postgre
 

Hi,

 

Sorry I don’t understand what= you are suggesting re the pg_hba file.

 

__

 

From: Wim Bertels <wim.bertels@ucll.be>
Sent: 20 August 2018 14:30
To: pgsql-admin@lists.postgresql.org; s.dunand@sirap.fr
Subject: Re: Setting up SSL for postgre

 

 

 

pg_hba.conf

# TYPE  DATABASE        USER=             CIDR-ADD= RESS            METH= OD

 

# IPv4 local & remote connections:

host    all       =       all       = ;      127.0.0.1/32     &= nbsp;      trust

hostssl all         postgres=     0.0.0.0/0        = ;     cert

 

cert method for auth, hence this behaviour (client cert..)

 

extra tip:

h= ttps://duckduckgo.com/?q=3Dletsencrypt+postgresql

for official server side certificates

 

mvg,

 Bertels Wim

 

Mark

__

&nbs= p;


This page helped me :
https://www.depesz.com/2015/05/11/how-to-setup-ssl-conn= ections-and-authentication/

Best regards,
St=E9phane

--_000_153492595297449431ucllbe_--