Received: from maia.hub.org (unknown [200.46.204.183]) by mail.postgresql.org (Postfix) with ESMTP id 53815633D53 for ; Fri, 16 Apr 2010 04:34:32 -0300 (ADT) Received: from mail.postgresql.org ([200.46.204.86]) by maia.hub.org (mx1.hub.org [200.46.204.183]) (amavisd-maia, port 10024) with ESMTP id 98041-09 for ; Fri, 16 Apr 2010 07:34:21 +0000 (UTC) X-Greylist: domain auto-whitelisted by SQLgrey-1.7.6 Received: from mail.gmx.net (mail.gmx.net [213.165.64.20]) by mail.postgresql.org (Postfix) with SMTP id 4997863219C for ; Fri, 16 Apr 2010 04:34:21 -0300 (ADT) Received: (qmail 28461 invoked by uid 0); 16 Apr 2010 07:34:19 -0000 Received: from 193.194.157.126 by www055.gmx.net with HTTP; Fri, 16 Apr 2010 09:34:17 +0200 (CEST) Content-Type: text/plain; charset="iso-8859-1" Date: Fri, 16 Apr 2010 09:34:17 +0200 From: =?iso-8859-1?Q?=22Martin_M=FCnstermann=22?= In-Reply-To: Message-ID: <20100416073417.132000@gmx.net> MIME-Version: 1.0 References: <201004150206.o3F26U427784@momjian.us> <20100415074542.137300@gmx.net> Subject: Re: PostgreSQL with SSL To: Jose Berardo , pgsql-admin@postgresql.org, bruce@momjian.us X-Authenticated: #740997 X-Flags: 0001 X-Mailer: WWW-Mail 6100 (Global Message Exchange) X-Priority: 3 X-Provags-ID: V01U2FsdGVkX1/9nO947G397AnfZSrBWzho26j/X7YntdnA/VhV6p TAA2rWiEvKQxTSrWdDNVtiH+T/doNJiZtCJA== Content-Transfer-Encoding: 8bit X-GMX-UID: nXutCv5HfW47N78UfGVoOh1udmllcgUP X-FuHaFi: 0.63 X-Virus-Scanned: Maia Mailguard 1.0.1 X-Spam-Status: No, hits=0.801 tagged_above=-10 required=5 tests=BAYES_50=0.8, FREEMAIL_FROM=0.001 X-Spam-Level: X-Archive-Number: 201004/207 X-Sequence-Number: 34301 Hello. > > > I'm trying to use the java keytool in place of openssl. > > > - I believe that it not possible to start the PostgreSQL server > without > > > openssl (and ssl-dev package in debian), is it correct? > > > > Yes, I don't think the java keytool works. > > Oh, the documentation defeated me twice. The server reads the openssl > configuration at start time too. > The keytool may be used only to generate the key pair and the certificate, > but it can not export the private key from its keystore. You need another > tool or to write a Java code to do that. OpenSSL has two ways to store private keys: 1. an own proprietary format 2. standard PKCS#8 The default as used in the postgresql doc is to produce the proprietary format. Don't know if PostgreSQL can handle PKCS#8 keys. If you'd like to check, here is a command to produce PKCS#8: openssl pkcs8 -in server.key -out server.p8 -topk8 Jose, writing a tutorial sounds promising. If I can be of any help, just contact me. Martin -- GRATIS für alle GMX-Mitglieder: Die maxdome Movie-FLAT! Jetzt freischalten unter http://portal.gmx.net/de/go/maxdome01