pg.ddx.io pgsql-admin@postgresql.org mailing list archive
help / color / mirror / Atom feedCert verify failed on client side after renewal of certs
4+ messages / 3 participants
[nested] [flat]
* Cert verify failed on client side after renewal of certs
@ 2014-09-18 20:57 Axel Rau <Axel.Rau@chaos1.de>
0 siblings, 1 reply; 4+ messages in thread
From: Axel Rau @ 2014-09-18 20:57 UTC (permalink / raw)
To: pgsql-admin
Hi all,
I’m getting
psql: SSL error: certificate verify failed
after renewing server and client certs.
Both certs are validated ok by openssl:
- - -
openssl verify -verbose -CAfile ca_cert.pem -purpose sslserver /usr/local/pgsql/data-l/db1.in.chaos1.de_server_cert.pem
/usr/local/pgsql/data-l/db1.in.chaos1.de_server_cert.pem: OK
- - -
openssl verify -verbose -CAfile ca_cert.pem -purpose sslclient db1.in.chaos1.de_server_cert.pem
db1.in.chaos1.de_server_cert.pem: OK
- - -
x509 extensions of server cert are
- - -
X509v3 Subject Key Identifier:
E2:F8:B9:D0:94:F2:70:BD:BE:84:EE:5C:7B:45:95:47:E4:9F:49:3B
X509v3 Basic Constraints: critical
CA:FALSE
X509v3 Key Usage: critical
Digital Signature, Key Encipherment
X509v3 Extended Key Usage: critical
TLS Web Server Authentication
X509v3 Subject Alternative Name: critical
DNS:some.host, DNS:another host
- - -
and of client cert
- - -
X509v3 Subject Key Identifier:
E2:F8:B9:D0:94:F2:70:BD:BE:84:EE:5C:7B:45:95:47:E4:9F:49:3B
X509v3 Basic Constraints: critical
CA:FALSE
X509v3 Key Usage: critical
Digital Signature
X509v3 Extended Key Usage: critical
TLS Web Client Authentication
X509v3 Subject Alternative Name: critical
DNS:some.host, DNS:another host
- - -
How can this be?
What am I doing wrong?
Axel
PS: This is still this issue:
http://article.gmane.org/gmane.comp.db.postgresql.admin/38559
—
PGP-Key:29E99DD6 ☀ +49 151 2300 9283 ☀ computing @ chaos claudius
--
Sent via pgsql-admin mailing list (pgsql-admin@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-admin
^ permalink raw reply [nested|flat] 4+ messages in thread
* Re: Cert verify failed on client side after renewal of certs
@ 2014-09-23 13:51 Axel Rau <Axel.Rau@Chaos1.DE>
parent: Axel Rau <Axel.Rau@chaos1.de>
0 siblings, 1 reply; 4+ messages in thread
From: Axel Rau @ 2014-09-23 13:51 UTC (permalink / raw)
To: pgsql-admin
The problem below disappears if I remove client key and cert from ~/.postgresql, just keeping root.crt.
Which subject CN or Subject alternate name should I use with the client cert?
User name or FQDN of client host comes into mind. Docs are unclear in that point.
Axel
Am 18.09.2014 um 22:57 schrieb Axel Rau <Axel.Rau@chaos1.de>:
> Hi all,
>
> I’m getting
> psql: SSL error: certificate verify failed
> after renewing server and client certs.
> Both certs are validated ok by openssl:
> - - -
> openssl verify -verbose -CAfile ca_cert.pem -purpose sslserver /usr/local/pgsql/data-l/db1.in.chaos1.de_server_cert.pem
> /usr/local/pgsql/data-l/db1.in.chaos1.de_server_cert.pem: OK
> - - -
> openssl verify -verbose -CAfile ca_cert.pem -purpose sslclient db1.in.chaos1.de_server_cert.pem
> db1.in.chaos1.de_server_cert.pem: OK
> - - -
> x509 extensions of server cert are
> - - -
> X509v3 Subject Key Identifier:
> E2:F8:B9:D0:94:F2:70:BD:BE:84:EE:5C:7B:45:95:47:E4:9F:49:3B
> X509v3 Basic Constraints: critical
> CA:FALSE
> X509v3 Key Usage: critical
> Digital Signature, Key Encipherment
> X509v3 Extended Key Usage: critical
> TLS Web Server Authentication
> X509v3 Subject Alternative Name: critical
> DNS:some.host, DNS:another host
> - - -
> and of client cert
> - - -
> X509v3 Subject Key Identifier:
> E2:F8:B9:D0:94:F2:70:BD:BE:84:EE:5C:7B:45:95:47:E4:9F:49:3B
> X509v3 Basic Constraints: critical
> CA:FALSE
> X509v3 Key Usage: critical
> Digital Signature
> X509v3 Extended Key Usage: critical
> TLS Web Client Authentication
> X509v3 Subject Alternative Name: critical
> DNS:some.host, DNS:another host
> - - -
> How can this be?
> What am I doing wrong?
>
> Axel
> PS: This is still this issue:
> http://article.gmane.org/gmane.comp.db.postgresql.admin/38559
> —
> PGP-Key:29E99DD6 ☀ +49 151 2300 9283 ☀ computing @ chaos claudius
>
>
>
> --
> Sent via pgsql-admin mailing list (pgsql-admin@postgresql.org)
> To make changes to your subscription:
> http://www.postgresql.org/mailpref/pgsql-admin
---
PGP-Key:29E99DD6 ☀ +49 151 2300 9283 ☀ computing @ chaos claudius
--
Sent via pgsql-admin mailing list (pgsql-admin@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-admin
^ permalink raw reply [nested|flat] 4+ messages in thread
* Re: Cert verify failed on client side after renewal of certs
@ 2014-09-24 05:22 Adalkonda Harshad <adalkondaharshad@gmail.com>
parent: Axel Rau <Axel.Rau@Chaos1.DE>
0 siblings, 1 reply; 4+ messages in thread
From: Adalkonda Harshad @ 2014-09-24 05:22 UTC (permalink / raw)
To: Axel Rau <Axel.Rau@Chaos1.DE>; pgsql-admin
On 23-09-2014 19:21, Axel Rau wrote:
> The problem below disappears if I remove client key and cert from ~/.postgresql, just keeping root.crt.
> Which subject CN or Subject alternate name should I use with the client cert?
> User name or FQDN of client host comes into mind. Docs are unclear in that point.
>
> Axel
>
> Am 18.09.2014 um 22:57 schrieb Axel Rau <Axel.Rau@chaos1.de>:
>
>> Hi all,
>>
>> I’m getting
>> psql: SSL error: certificate verify failed
>> after renewing server and client certs.
>> Both certs are validated ok by openssl:
>> - - -
>> openssl verify -verbose -CAfile ca_cert.pem -purpose sslserver /usr/local/pgsql/data-l/db1.in.chaos1.de_server_cert.pem
>> /usr/local/pgsql/data-l/db1.in.chaos1.de_server_cert.pem: OK
>> - - -
>> openssl verify -verbose -CAfile ca_cert.pem -purpose sslclient db1.in.chaos1.de_server_cert.pem
>> db1.in.chaos1.de_server_cert.pem: OK
>> - - -
>> x509 extensions of server cert are
>> - - -
>> X509v3 Subject Key Identifier:
>> E2:F8:B9:D0:94:F2:70:BD:BE:84:EE:5C:7B:45:95:47:E4:9F:49:3B
>> X509v3 Basic Constraints: critical
>> CA:FALSE
>> X509v3 Key Usage: critical
>> Digital Signature, Key Encipherment
>> X509v3 Extended Key Usage: critical
>> TLS Web Server Authentication
>> X509v3 Subject Alternative Name: critical
>> DNS:some.host, DNS:another host
>> - - -
>> and of client cert
>> - - -
>> X509v3 Subject Key Identifier:
>> E2:F8:B9:D0:94:F2:70:BD:BE:84:EE:5C:7B:45:95:47:E4:9F:49:3B
>> X509v3 Basic Constraints: critical
>> CA:FALSE
>> X509v3 Key Usage: critical
>> Digital Signature
>> X509v3 Extended Key Usage: critical
>> TLS Web Client Authentication
>> X509v3 Subject Alternative Name: critical
>> DNS:some.host, DNS:another host
>> - - -
>> How can this be?
>> What am I doing wrong?
>>
>> Axel
>> PS: This is still this issue:
>> http://article.gmane.org/gmane.comp.db.postgresql.admin/38559
>> —
>> PGP-Key:29E99DD6 ☀ +49 151 2300 9283 ☀ computing @ chaos claudius
>>
>>
>>
>> --
>> Sent via pgsql-admin mailing list (pgsql-admin@postgresql.org)
>> To make changes to your subscription:
>> http://www.postgresql.org/mailpref/pgsql-admin
> ---
> PGP-Key:29E99DD6 ☀ +49 151 2300 9283 ☀ computing @ chaos claudius
>
>
>
The CN should be User name of the database from which client is going to
login.
--
Harshad Adalkonda
Database Administrator
harshad.adalkonda@shreeyansh.com <mailto:harshad.adalkonda@shreeyansh.com>
Office: +919552687400/8400
http://www.shreeyansh.com
Twitter <%20> Google Plus <%20> Youtube <%20> Linkedin
<http://in.linkedin.com/in/prashanthranjalkar; Instagram <%20> Pintrest
<%20> Dribbble <%20> Skype <skype:harsh_ur1>
Attachments:
twitter-2.png (image/png, 676B) download
view image
google-plus.png (image/png, 686B) download
view image
youtube.png (image/png, 705B) download
view image
linkedin.png (image/png, 631B) download
view image
instagram.png (image/png, 1.5K) download
view image
pinterest.png (image/png, 1.5K) download
view image
dribbble.png (image/png, 889B) download
view image
skype.png (image/png, 800B) download
view image
* [RESOLVED]Re: Cert verify failed on client side after renewal of certs
@ 2014-09-24 09:00 Axel Rau <Axel.Rau@Chaos1.DE>
parent: Adalkonda Harshad <adalkondaharshad@gmail.com>
0 siblings, 0 replies; 4+ messages in thread
From: Axel Rau @ 2014-09-24 09:00 UTC (permalink / raw)
To: pgsql-admin
Am 24.09.2014 um 07:22 schrieb Adalkonda Harshad <adalkondaharshad@gmail.com>:
>
> On 23-09-2014 19:21, Axel Rau wrote:
>> The problem below disappears if I remove client key and cert from ~/.postgresql, just keeping root.crt.
>> Which subject CN or Subject alternate name should I use with the client cert?
>> User name or FQDN of client host comes into mind. Docs are unclear in that point.
>>
>> Axel
>>
>> Am 18.09.2014 um 22:57 schrieb Axel Rau <Axel.Rau@chaos1.de>:
>>
>>> Hi all,
>>>
>>> I’m getting
>>> psql: SSL error: certificate verify failed
>>> after renewing server and client certs.
>>> Both certs are validated ok by openssl:
>>> - - -
>>> openssl verify -verbose -CAfile ca_cert.pem -purpose sslserver /usr/local/pgsql/data-l/db1.in.chaos1.de_server_cert.pem
>>> /usr/local/pgsql/data-l/db1.in.chaos1.de_server_cert.pem: OK
>>> - - -
>>> openssl verify -verbose -CAfile ca_cert.pem -purpose sslclient db1.in.chaos1.de_server_cert.pem
>>> db1.in.chaos1.de_server_cert.pem: OK
>>> - - -
>>> x509 extensions of server cert are
>>> - - -
>>> X509v3 Subject Key Identifier:
>>> E2:F8:B9:D0:94:F2:70:BD:BE:84:EE:5C:7B:45:95:47:E4:9F:49:3B
>>> X509v3 Basic Constraints: critical
>>> CA:FALSE
>>> X509v3 Key Usage: critical
>>> Digital Signature, Key Encipherment
>>> X509v3 Extended Key Usage: critical
>>> TLS Web Server Authentication
>>> X509v3 Subject Alternative Name: critical
>>> DNS:some.host, DNS:another host
>>> - - -
>>> and of client cert
>>> - - -
>>> X509v3 Subject Key Identifier:
>>> E2:F8:B9:D0:94:F2:70:BD:BE:84:EE:5C:7B:45:95:47:E4:9F:49:3B
>>> X509v3 Basic Constraints: critical
>>> CA:FALSE
>>> X509v3 Key Usage: critical
>>> Digital Signature
>>> X509v3 Extended Key Usage: critical
>>> TLS Web Client Authentication
>>> X509v3 Subject Alternative Name: critical
>>> DNS:some.host, DNS:another host
>>> - - -
>>> How can this be?
>>> What am I doing wrong?
>>>
>>> Axel
>>> PS: This is still this issue:
>>> http://article.gmane.org/gmane.comp.db.postgresql.admin/38559
Thanks for your answer.
> The CN should be User name of the database from which client is going to login.
According to the docs, this is required with authentication by client cert (AbCC), which I did not use.
I created a cert with db user name as CN and no subject alternate name (SAN) and this solved my problem!
There should really be a hint in the docs that SSL does not work with client certs containing one or more SANs.
Now the next question: If I switch to AbCC, how can I configure more than one db user per login?
Thanks, Axel
---
PGP-Key:29E99DD6 ☀ +49 151 2300 9283 ☀ computing @ chaos claudius
^ permalink raw reply [nested|flat] 4+ messages in thread
end of thread, other threads:[~2014-09-24 09:00 UTC | newest]
Thread overview: 4+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2014-09-18 20:57 Cert verify failed on client side after renewal of certs Axel Rau <Axel.Rau@chaos1.de>
2014-09-23 13:51 ` Axel Rau <Axel.Rau@Chaos1.DE>
2014-09-24 05:22 ` Adalkonda Harshad <adalkondaharshad@gmail.com>
2014-09-24 09:00 ` Axel Rau <Axel.Rau@Chaos1.DE>
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox