From: Tom Lane <tgl@sss.pgh.pa.us>
To: John Scalia <jayknowsunix@gmail.com>
cc: pgsql-admin@postgresql.org
Subject: Re: SSL certificate revocation file will not load
In-reply-to: 
 <CABzCKRCjpiosAEVujuvBN+KOzdaQSJyLuo-TTQdmc98PqcKjNA@mail.gmail.com>
References: 
 <CABzCKRCjpiosAEVujuvBN+KOzdaQSJyLuo-TTQdmc98PqcKjNA@mail.gmail.com>
Comments: In-reply-to John Scalia <jayknowsunix@gmail.com>
	message dated "Fri, 09 Jun 2017 09:36:07 -0400"
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <23870.1497473425.1@sss.pgh.pa.us>
Content-Transfer-Encoding: quoted-printable
Date: Wed, 14 Jun 2017 16:50:25 -0400
Message-ID: <23871.1497473425@sss.pgh.pa.us>
Precedence: bulk
Sender: pgsql-admin-owner@postgresql.org

John Scalia <jayknowsunix@gmail.com> writes:
> I've got SSL working without the crl file, but when I set ssl_crl_file to
> use the one I have, it says FATAL on a restart and no SSL error reported.
> This is not very helpful.

Did you look into the postmaster log?  Experimenting with an intentionally
corrupted CRL file here, I get log messages along the lines of

2017-06-14 16:45:15.096 EDT [22759] LOG:  parameter "ssl_crl_file" changed =
to "root+client.crl"
2017-06-14 16:45:15.102 EDT [22759] LOG:  could not load SSL certificate re=
vocation list file "root+client.crl": bad base64 decode

The actually useful part of that comes out of OpenSSL, and we don't have
a lot of control about how specific it is ... but there should be
*something*.

			regards, tom lane


--=20
Sent via pgsql-admin mailing list (pgsql-admin@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-admin