DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma;
	h=message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references;
	b=xvAN+F3slpY8Mf8rZY/cm+kqW+p1WXAdrqSzccLQwLYobKcYTRIigz+60goMXMMx0IbFpFi1jNb2ylYAPzIITMKYv5yR3l9rVohbuBJ4rl/0QJTvkBrDL/Zme77RJUrX/6rG3GqnzG3ST1xbxfWrn6z/yAavtvLYW8pGsrYlCCw=
Message-ID: <4544e0330802031320l46448362wbc5bf73fec5374e7@mail.gmail.com>
Date: Sun, 3 Feb 2008 15:20:05 -0600
From: "Peter Koczan" <pjkoczan@gmail.com>
To: "Bronson, Allan B. (Mission Systems)" <Allan.Bronson@ngc.com>
Subject: Re: SSL question
Cc: pgsql-admin@postgresql.org
In-Reply-To: <EA2EEA7B13D0454FA5F956B5D715B8B90DE4C9@XMBTX121.northgrum.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
References: <EA2EEA7B13D0454FA5F956B5D715B8B90DE4C9@XMBTX121.northgrum.com>

On Feb 1, 2008 9:08 AM, Bronson, Allan B. (Mission Systems)
<Allan.Bronson@ngc.com> wrote:
> I am trying to create a SSl connection to PostGres using JDBC and am not
> sure if it is working.
>
> I read that you must have openssl on the client machine for the connection
> to take place.  I have turned ssl = on in the config file, created a cert
> and key file and placed them in the correct directory, created a truststore
> and add the ?ssl=true to the url for the client.  When I do all this I
> connect and get  data back from the db.  My confusion is when I read that I
> need openssl on the client machine to connect, since I can connect without
> openssl installed.  I do notice that if my truststore does not have the cert
> placed in it, I get an error saying missing certificate ( something like
> that ), does that mean ssl is working for the client and server?
>
> I am using Postgres 8.2 and have read that I may need to compile the
> Postgres src code with openssl for it to be enabled.  Is this correct or is
> SSL already compiled into the src code?
>
> Thanks to anyone who can provide information or point me in the right
> direction.  I am facing a tight deadline and don't have a ton of extra time
> to research this more.

I think you do need to compile PostgreSQL with SSL support. If you're
getting a vendor-made package (a .rpm or .deb, for instance), you
should do a little

As far as JDBC goes, check out
http://jdbc.postgresql.org/documentation/82/ssl.html (though it sounds
like you already have). I'm trying to get SSL support working with
JDBC as well, and I've found that guide very good.

Don't forget to edit your server's pg_hba.conf to allow or force
ssl-based connections, as well.

You should also ask your question on the JDBC list. They focus
exclusively on that and will be best able to help you.

Hope this helps.

Peter