pg.ddx.io pgsql-admin@postgresql.org mailing list archive
help / color / mirror / Atom feedSSL question
8+ messages / 7 participants
[nested] [flat]
* SSL question
@ 2008-02-01 15:08 Bronson, Allan B. (Mission Systems) <Allan.Bronson@ngc.com>
0 siblings, 2 replies; 8+ messages in thread
From: Bronson, Allan B. (Mission Systems) @ 2008-02-01 15:08 UTC (permalink / raw)
To: pgsql-admin
I am trying to create a SSl connection to PostGres using JDBC and am not
sure if it is working.
I read that you must have openssl on the client machine for the
connection to take place. I have turned ssl = on in the config file,
created a cert and key file and placed them in the correct directory,
created a truststore and add the ?ssl=true to the url for the client.
When I do all this I connect and get data back from the db. My
confusion is when I read that I need openssl on the client machine to
connect, since I can connect without openssl installed. I do notice
that if my truststore does not have the cert placed in it, I get an
error saying missing certificate ( something like that ), does that mean
ssl is working for the client and server?
I am using Postgres 8.2 and have read that I may need to compile the
Postgres src code with openssl for it to be enabled. Is this correct or
is SSL already compiled into the src code?
Thanks to anyone who can provide information or point me in the right
direction. I am facing a tight deadline and don't have a ton of extra
time to research this more.
allan
^ permalink raw reply [nested|flat] 8+ messages in thread
* Re: SSL question
@ 2008-02-03 10:38 Tino Schwarze <postgresql@tisc.de>
parent: Bronson, Allan B. (Mission Systems) <Allan.Bronson@ngc.com>
1 sibling, 0 replies; 8+ messages in thread
From: Tino Schwarze @ 2008-02-03 10:38 UTC (permalink / raw)
To: pgsql-admin
On Fri, Feb 01, 2008 at 09:08:23AM -0600, Bronson, Allan B. (Mission Systems) wrote:
> I am trying to create a SSl connection to PostGres using JDBC and am not
> sure if it is working.
>
> I read that you must have openssl on the client machine for the
> connection to take place.
You don't need openssl if you use JDBC since SSL-support is part of
Java and the JDBC-driver will handle the SSL stuff.
I've never used SSL connections though, so this is a bit of guessing on
my side.
> I have turned ssl = on in the config file,
> created a cert and key file and placed them in the correct directory,
> created a truststore and add the ?ssl=true to the url for the client.
> When I do all this I connect and get data back from the db. My
> confusion is when I read that I need openssl on the client machine to
> connect, since I can connect without openssl installed. I do notice
> that if my truststore does not have the cert placed in it, I get an
> error saying missing certificate ( something like that ), does that mean
> ssl is working for the client and server?
I'd simply take a packet sniffer like wireshark and look at the network
traffic with and without SSL. That way you'll see what is going on and
whether it's encrypted.
HTH,
Tino.
--
www.craniosacralzentrum.de
www.spiritualdesign-chemnitz.de
Tino Schwarze * Lortzingstraße 21 * 09119 Chemnitz
^ permalink raw reply [nested|flat] 8+ messages in thread
* Re: SSL question
@ 2008-02-03 21:20 Peter Koczan <pjkoczan@gmail.com>
parent: Bronson, Allan B. (Mission Systems) <Allan.Bronson@ngc.com>
1 sibling, 0 replies; 8+ messages in thread
From: Peter Koczan @ 2008-02-03 21:20 UTC (permalink / raw)
To: Bronson, Allan B. (Mission Systems) <Allan.Bronson@ngc.com>; +Cc: pgsql-admin
On Feb 1, 2008 9:08 AM, Bronson, Allan B. (Mission Systems)
<Allan.Bronson@ngc.com> wrote:
> I am trying to create a SSl connection to PostGres using JDBC and am not
> sure if it is working.
>
> I read that you must have openssl on the client machine for the connection
> to take place. I have turned ssl = on in the config file, created a cert
> and key file and placed them in the correct directory, created a truststore
> and add the ?ssl=true to the url for the client. When I do all this I
> connect and get data back from the db. My confusion is when I read that I
> need openssl on the client machine to connect, since I can connect without
> openssl installed. I do notice that if my truststore does not have the cert
> placed in it, I get an error saying missing certificate ( something like
> that ), does that mean ssl is working for the client and server?
>
> I am using Postgres 8.2 and have read that I may need to compile the
> Postgres src code with openssl for it to be enabled. Is this correct or is
> SSL already compiled into the src code?
>
> Thanks to anyone who can provide information or point me in the right
> direction. I am facing a tight deadline and don't have a ton of extra time
> to research this more.
I think you do need to compile PostgreSQL with SSL support. If you're
getting a vendor-made package (a .rpm or .deb, for instance), you
should do a little
As far as JDBC goes, check out
http://jdbc.postgresql.org/documentation/82/ssl.html (though it sounds
like you already have). I'm trying to get SSL support working with
JDBC as well, and I've found that guide very good.
Don't forget to edit your server's pg_hba.conf to allow or force
ssl-based connections, as well.
You should also ask your question on the JDBC list. They focus
exclusively on that and will be best able to help you.
Hope this helps.
Peter
^ permalink raw reply [nested|flat] 8+ messages in thread
* SSL question
@ 2010-04-13 17:04 Jeffrey Gaynor <jgaynor@ncsa.uiuc.edu>
0 siblings, 1 reply; 8+ messages in thread
From: Jeffrey Gaynor @ 2010-04-13 17:04 UTC (permalink / raw)
To: pgsql-admin
I am trying to get SSL to to work with Postgres 8.1 under CentOS 5. The situation is that I have a key and cert I must use (so no self-signing) and attempting to access the database yields the message that no client cert was found in the ~/.postgresql directory.
It is my understanding that I do not need a client cert, correct?
I tried to fix this by setting the option "clientcert=0" in my pg_hda.conf file.
Q: How to I make it so that no client cert is required?
I'm a bit of a newbie with Postgres, so any and all information is happily received.
Thanks!
^ permalink raw reply [nested|flat] 8+ messages in thread
* Re: SSL question
@ 2010-04-20 15:40 Jeffrey Gaynor <jgaynor@ncsa.uiuc.edu>
parent: Jeffrey Gaynor <jgaynor@ncsa.uiuc.edu>
0 siblings, 0 replies; 8+ messages in thread
From: Jeffrey Gaynor @ 2010-04-20 15:40 UTC (permalink / raw)
To: pgsql-admin
Never mind. I had misnamed the cert to root rather than server. Problem fixed.
Oh and delaying posts a week sure is a great way to get people to expand their horizons. :o)
----- Original Message -----
From: "Jeffrey Gaynor" <jgaynor@ncsa.uiuc.edu>
To: pgsql-admin@postgresql.org
Sent: Tuesday, April 13, 2010 12:04:43 PM
Subject: [ADMIN] SSL question
I am trying to get SSL to to work with Postgres 8.1 under CentOS 5. The situation is that I have a key and cert I must use (so no self-signing) and attempting to access the database yields the message that no client cert was found in the ~/.postgresql directory.
It is my understanding that I do not need a client cert, correct?
I tried to fix this by setting the option "clientcert=0" in my pg_hda.conf file.
Q: How to I make it so that no client cert is required?
I'm a bit of a newbie with Postgres, so any and all information is happily received.
Thanks!
--
Sent via pgsql-admin mailing list (pgsql-admin@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-admin
^ permalink raw reply [nested|flat] 8+ messages in thread
* SSL question
@ 2013-02-05 01:49 CS DBA <cs_dba@consistentstate.com>
0 siblings, 2 replies; 8+ messages in thread
From: CS DBA @ 2013-02-05 01:49 UTC (permalink / raw)
To: pgsql-admin
All;
We have a client that is asking for a service as follows:
- a virtual machine in our data center
- they want to upload files to the VM via sftp
- they want to connect to a local db server on the VM via SSL
Here's my question;
Do I need to pay for an official SSL cert? If so, they seem to be tied
to an apache config. Am I missing something?
Thanks in advance
--
Sent via pgsql-admin mailing list (pgsql-admin@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-admin
^ permalink raw reply [nested|flat] 8+ messages in thread
* Re: SSL question
@ 2013-02-05 03:19 Johnny Tan <johnnydtan@gmail.com>
parent: CS DBA <cs_dba@consistentstate.com>
1 sibling, 0 replies; 8+ messages in thread
From: Johnny Tan @ 2013-02-05 03:19 UTC (permalink / raw)
To: CS DBA <cs_dba@consistentstate.com>; +Cc: pgsql-admin
On Feb 4, 2013 8:50 PM, "CS DBA" <cs_dba@consistentstate.com> wrote:
>
> All;
>
> We have a client that is asking for a service as follows:
>
> - a virtual machine in our data center
> - they want to upload files to the VM via sftp
> - they want to connect to a local db server on the VM via SSL
>
> Here's my question;
> Do I need to pay for an official SSL cert?
No, you can use stunnel or setup a simple vpn.
^ permalink raw reply [nested|flat] 8+ messages in thread
* Re: SSL question
@ 2013-02-05 08:32 Albe Laurenz <laurenz.albe@wien.gv.at>
parent: CS DBA <cs_dba@consistentstate.com>
1 sibling, 0 replies; 8+ messages in thread
From: Albe Laurenz @ 2013-02-05 08:32 UTC (permalink / raw)
To: CS DBA *EXTERN* <cs_dba@consistentstate.com>; pgsql-admin
CS DBA wrote:
> We have a client that is asking for a service as follows:
>
> - a virtual machine in our data center
> - they want to upload files to the VM via sftp
> - they want to connect to a local db server on the VM via SSL
>
> Here's my question;
> Do I need to pay for an official SSL cert? If so, they seem to be tied
> to an apache config. Am I missing something?
I don't see how Apache comes in here.
I hope I understand correctly that your customer wants
a PostgreSQL client on his/her machine to connect to
a PostgreSQL server on your machine with SSL.
Will the connection be via the C API, JDBC, Npgsql
or something else?
Do you want to use SSL for encryption or also for
authentication?
If you only need encryption, you can use a random
self signed certificate on the database server, and
you don't need anything on the client.
If you want to authenticate the client with SSL,
you have to make sure that the client's certificates
are signed by a certification authority that your
server trusts. Since that is in your hands, there's
no (technical) need to use a commercial certification
authority.
Suggested reading:
http://www.postgresql.org/docs/current/static/ssl-tcp.html
http://www.postgresql.org/docs/current/static/auth-methods.html#AUTH-CERT
http://www.postgresql.org/docs/current/static/runtime-config-connection.html#RUNTIME-CONFIG-CONNECTI...
Yours,
Laurenz Albe
--
Sent via pgsql-admin mailing list (pgsql-admin@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-admin
^ permalink raw reply [nested|flat] 8+ messages in thread
end of thread, other threads:[~2013-02-05 08:32 UTC | newest]
Thread overview: 8+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2008-02-01 15:08 SSL question Bronson, Allan B. (Mission Systems) <Allan.Bronson@ngc.com>
2008-02-03 10:38 ` Tino Schwarze <postgresql@tisc.de>
2008-02-03 21:20 ` Peter Koczan <pjkoczan@gmail.com>
2010-04-13 17:04 SSL question Jeffrey Gaynor <jgaynor@ncsa.uiuc.edu>
2010-04-20 15:40 ` Jeffrey Gaynor <jgaynor@ncsa.uiuc.edu>
2013-02-05 01:49 SSL question CS DBA <cs_dba@consistentstate.com>
2013-02-05 03:19 ` Johnny Tan <johnnydtan@gmail.com>
2013-02-05 08:32 ` Albe Laurenz <laurenz.albe@wien.gv.at>
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox