From: "Martin Münstermann" <mmuenst@gmx.de>
To: Jose Berardo <joseberardo@gmail.com>
To: pgsql-admin@postgresql.org
To: bruce@momjian.us
Subject: Re: PostgreSQL with SSL
Date: Fri, 16 Apr 2010 09:34:17 +0200
Message-ID: <20100416073417.132000@gmx.net> (raw)
In-Reply-To: <j2o9009a4451004151422r4cde72f4o868d4e7017cfab5b@mail.gmail.com>
References: <201004150206.o3F26U427784@momjian.us>
<20100415074542.137300@gmx.net>
<j2o9009a4451004151422r4cde72f4o868d4e7017cfab5b@mail.gmail.com>
Hello.
> > > I'm trying to use the java keytool in place of openssl.
> > > - I believe that it not possible to start the PostgreSQL server
> without
> > > openssl (and ssl-dev package in debian), is it correct?
> >
> > Yes, I don't think the java keytool works.
>
> Oh, the documentation defeated me twice. The server reads the openssl
> configuration at start time too.
> The keytool may be used only to generate the key pair and the certificate,
> but it can not export the private key from its keystore. You need another
> tool or to write a Java code to do that.
OpenSSL has two ways to store private keys:
1. an own proprietary format
2. standard PKCS#8
The default as used in the postgresql doc is to produce the proprietary format.
Don't know if PostgreSQL can handle PKCS#8 keys.
If you'd like to check, here is a command to produce PKCS#8:
openssl pkcs8 -in server.key -out server.p8 -topk8
Jose, writing a tutorial sounds promising. If I can be of any help, just contact me.
Martin
--
GRATIS für alle GMX-Mitglieder: Die maxdome Movie-FLAT!
Jetzt freischalten unter http://portal.gmx.net/de/go/maxdome01
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-admin@postgresql.org
Cc: mmuenst@gmx.de, joseberardo@gmail.com, bruce@momjian.us
Subject: Re: PostgreSQL with SSL
In-Reply-To: <20100416073417.132000@gmx.net>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox