From: Adalkonda Harshad <adalkondaharshad@gmail.com>
To: Axel Rau <Axel.Rau@Chaos1.DE>
To: pgsql-admin@postgresql.org
Subject: Re: Cert verify failed on client side after renewal of certs
Date: Wed, 24 Sep 2014 10:52:49 +0530
Message-ID: <54225529.1020507@gmail.com> (raw)
In-Reply-To: <74256716-042C-45E6-A2F2-09B0D0D34666@Chaos1.DE>
References: <EDEF718B-B5CE-464C-AFE2-CAAAE6A0B8A5@chaos1.de>
<74256716-042C-45E6-A2F2-09B0D0D34666@Chaos1.DE>
List-Unsubscribe: <mailto:majordomo@postgresql.org?body=unsub%20pgsql-admin>
On 23-09-2014 19:21, Axel Rau wrote:
> The problem below disappears if I remove client key and cert from ~/.postgresql, just keeping root.crt.
> Which subject CN or Subject alternate name should I use with the client cert?
> User name or FQDN of client host comes into mind. Docs are unclear in that point.
>
> Axel
>
> Am 18.09.2014 um 22:57 schrieb Axel Rau <Axel.Rau@chaos1.de>:
>
>> Hi all,
>>
>> I’m getting
>> psql: SSL error: certificate verify failed
>> after renewing server and client certs.
>> Both certs are validated ok by openssl:
>> - - -
>> openssl verify -verbose -CAfile ca_cert.pem -purpose sslserver /usr/local/pgsql/data-l/db1.in.chaos1.de_server_cert.pem
>> /usr/local/pgsql/data-l/db1.in.chaos1.de_server_cert.pem: OK
>> - - -
>> openssl verify -verbose -CAfile ca_cert.pem -purpose sslclient db1.in.chaos1.de_server_cert.pem
>> db1.in.chaos1.de_server_cert.pem: OK
>> - - -
>> x509 extensions of server cert are
>> - - -
>> X509v3 Subject Key Identifier:
>> E2:F8:B9:D0:94:F2:70:BD:BE:84:EE:5C:7B:45:95:47:E4:9F:49:3B
>> X509v3 Basic Constraints: critical
>> CA:FALSE
>> X509v3 Key Usage: critical
>> Digital Signature, Key Encipherment
>> X509v3 Extended Key Usage: critical
>> TLS Web Server Authentication
>> X509v3 Subject Alternative Name: critical
>> DNS:some.host, DNS:another host
>> - - -
>> and of client cert
>> - - -
>> X509v3 Subject Key Identifier:
>> E2:F8:B9:D0:94:F2:70:BD:BE:84:EE:5C:7B:45:95:47:E4:9F:49:3B
>> X509v3 Basic Constraints: critical
>> CA:FALSE
>> X509v3 Key Usage: critical
>> Digital Signature
>> X509v3 Extended Key Usage: critical
>> TLS Web Client Authentication
>> X509v3 Subject Alternative Name: critical
>> DNS:some.host, DNS:another host
>> - - -
>> How can this be?
>> What am I doing wrong?
>>
>> Axel
>> PS: This is still this issue:
>> http://article.gmane.org/gmane.comp.db.postgresql.admin/38559
>> —
>> PGP-Key:29E99DD6 ☀ +49 151 2300 9283 ☀ computing @ chaos claudius
>>
>>
>>
>> --
>> Sent via pgsql-admin mailing list (pgsql-admin@postgresql.org)
>> To make changes to your subscription:
>> http://www.postgresql.org/mailpref/pgsql-admin
> ---
> PGP-Key:29E99DD6 ☀ +49 151 2300 9283 ☀ computing @ chaos claudius
>
>
>
The CN should be User name of the database from which client is going to
login.
--
Harshad Adalkonda
Database Administrator
harshad.adalkonda@shreeyansh.com <mailto:harshad.adalkonda@shreeyansh.com>
Office: +919552687400/8400
http://www.shreeyansh.com
Twitter <%20> Google Plus <%20> Youtube <%20> Linkedin
<http://in.linkedin.com/in/prashanthranjalkar; Instagram <%20> Pintrest
<%20> Dribbble <%20> Skype <skype:harsh_ur1>
Attachments:twitter-2.png (image/png, 676B) downloadview imagegoogle-plus.png (image/png, 686B) downloadview imageyoutube.png (image/png, 705B) downloadview imagelinkedin.png (image/png, 631B) downloadview imageinstagram.png (image/png, 1.5K) downloadview imagepinterest.png (image/png, 1.5K) downloadview imagedribbble.png (image/png, 889B) downloadview imageskype.png (image/png, 800B) downloadview image
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-admin@postgresql.org
Cc: adalkondaharshad@gmail.com, Axel.Rau@Chaos1.DE
Subject: Re: Cert verify failed on client side after renewal of certs
In-Reply-To: <54225529.1020507@gmail.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox