From: Tom Lane <tgl@sss.pgh.pa.us>
To: John Scalia <jayknowsunix@gmail.com>
Cc: pgsql-admin@postgresql.org
Subject: Re: SSL certificate revocation file will not load
Date: Wed, 14 Jun 2017 16:50:25 -0400
Message-ID: <23871.1497473425@sss.pgh.pa.us> (raw)
In-Reply-To: <CABzCKRCjpiosAEVujuvBN+KOzdaQSJyLuo-TTQdmc98PqcKjNA@mail.gmail.com>
References: <CABzCKRCjpiosAEVujuvBN+KOzdaQSJyLuo-TTQdmc98PqcKjNA@mail.gmail.com>
List-Unsubscribe: <mailto:majordomo@postgresql.org?body=unsub%20pgsql-admin>
John Scalia <jayknowsunix@gmail.com> writes:
> I've got SSL working without the crl file, but when I set ssl_crl_file to
> use the one I have, it says FATAL on a restart and no SSL error reported.
> This is not very helpful.
Did you look into the postmaster log? Experimenting with an intentionally
corrupted CRL file here, I get log messages along the lines of
2017-06-14 16:45:15.096 EDT [22759] LOG: parameter "ssl_crl_file" changed to "root+client.crl"
2017-06-14 16:45:15.102 EDT [22759] LOG: could not load SSL certificate revocation list file "root+client.crl": bad base64 decode
The actually useful part of that comes out of OpenSSL, and we don't have
a lot of control about how specific it is ... but there should be
*something*.
regards, tom lane
--
Sent via pgsql-admin mailing list (pgsql-admin@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-admin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-admin@postgresql.org
Cc: tgl@sss.pgh.pa.us, jayknowsunix@gmail.com
Subject: Re: SSL certificate revocation file will not load
In-Reply-To: <23871.1497473425@sss.pgh.pa.us>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox