Received: from localhost (unknown [200.46.204.183]) by mail.postgresql.org (Postfix) with ESMTP id B4C7C64FFEC for ; Wed, 31 Dec 2008 11:09:25 -0400 (AST) Received: from mail.postgresql.org ([200.46.204.86]) by localhost (mx1.hub.org [200.46.204.183]) (amavisd-maia, port 10024) with ESMTP id 84082-04 for ; Wed, 31 Dec 2008 11:09:23 -0400 (AST) X-Greylist: from auto-whitelisted by SQLgrey-1.7.6 Received: from locust.cns.vt.edu (locust.cns.vt.edu [198.82.169.14]) by mail.postgresql.org (Postfix) with ESMTP id AE6BA64FE37 for ; Wed, 31 Dec 2008 11:09:22 -0400 (AST) Received: by locust.cns.vt.edu (Postfix, from userid 986) id D470A118DBD; Wed, 31 Dec 2008 10:09:20 -0500 (EST) Date: Wed, 31 Dec 2008 10:09:20 -0500 From: Ray Stell To: Carol Walter Cc: pgsql-admin@postgresql.org Subject: Re: ssl database connection problems... Message-ID: <20081231150920.GB10149@cns.vt.edu> References: <752F2E74-9F28-4E3D-869C-93357751AFA0@indiana.edu> <20081230023630.GA19239@cns.vt.edu> <4D15E432-79CD-4D0E-ACDD-BC1ABCC5BAFD@indiana.edu> <20081231014235.GA10365@cns.vt.edu> <7231B567-C7EE-4897-B209-1C1E17CEC83F@indiana.edu> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <7231B567-C7EE-4897-B209-1C1E17CEC83F@indiana.edu> User-Agent: Mutt/1.5.17 (2007-11-01) X-Virus-Scanned: Maia Mailguard 1.0.1 X-Spam-Status: No, hits=0 tagged_above=0 required=5 tests=none X-Spam-Level: X-Archive-Number: 200812/212 X-Sequence-Number: 31045 On Wed, Dec 31, 2008 at 09:19:12AM -0500, Carol Walter wrote: > Here's the output from s_client & s_server commands... > > # openssl s_client > connect: Connection refused > connect:errno=146 oh, I think you need to use some more flags. Take a look at this howto: http://www.madboa.com/geek/openssl/ > I don't have a root.crt file. > > # openssl verify -CAfile ./root.crt testcert.pem right, my file root.ca was self generated using openssl (I'm the CA). It is analogous to the CA chain you might buy from Thawte or some other trusted authority. It is the file that I used to sign my server crt file, testcrt.pem. ` Yeah, you don't need it unless you want to auth a login with pg, but we are not there yet. You need to verify that openssl is not fubar first, right? Best in 2009, everyone: Carbon-free city under construction, cool! http://cosmos.bcst.yahoo.com/up/ynews;_ylt=AgPr9FSysEdu1cF5ydA9CPr737YB?ch=4226722&cl=11310260&lang=en