Received: from localhost (unknown [200.46.204.183]) by mail.postgresql.org (Postfix) with ESMTP id 5957064FEC1 for ; Mon, 29 Dec 2008 22:42:03 -0400 (AST) Received: from mail.postgresql.org ([200.46.204.86]) by localhost (mx1.hub.org [200.46.204.183]) (amavisd-maia, port 10024) with ESMTP id 97195-02 for ; Mon, 29 Dec 2008 22:42:00 -0400 (AST) X-Greylist: delayed 00:05:27.883936 by SQLgrey-1.7.6 Received: from locust.cns.vt.edu (locust.cns.vt.edu [198.82.169.14]) by mail.postgresql.org (Postfix) with ESMTP id 83D1F64FD2F for ; Mon, 29 Dec 2008 22:42:00 -0400 (AST) Received: by locust.cns.vt.edu (Postfix, from userid 986) id 5DFE2118DBB; Mon, 29 Dec 2008 21:36:30 -0500 (EST) Date: Mon, 29 Dec 2008 21:36:30 -0500 From: Ray Stell To: Carol Walter Cc: pgsql-admin@postgresql.org Subject: Re: ssl database connection problems... Message-ID: <20081230023630.GA19239@cns.vt.edu> References: <752F2E74-9F28-4E3D-869C-93357751AFA0@indiana.edu> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <752F2E74-9F28-4E3D-869C-93357751AFA0@indiana.edu> User-Agent: Mutt/1.5.17 (2007-11-01) X-Virus-Scanned: Maia Mailguard 1.0.1 X-Spam-Status: No, hits=0 tagged_above=0 required=5 tests=none X-Spam-Level: X-Archive-Number: 200812/196 X-Sequence-Number: 31029 On Mon, Dec 29, 2008 at 04:23:30PM -0500, Carol Walter wrote: > "with openssl" when I initially configured the server. Are there other > things that need to be done to get openssl started on the database server? > How can I diagnose this problem? > The files server.key, server.crt, root.crt, and root.crl are only examined during server start; so you must restart the server for changes in them to take effect. http://www.postgresql.org/docs/8.3/interactive/ssl-tcp.html It's been awhile since I played with this, but there's something about an environment var, PGSSLMODE. You can use openssl to verify the server/root ca correctness like this: openssl verify -CAfile ./root.crt testcert.pem assuming openssl in the mix.