pg.ddx.io pgsql-admin@postgresql.org mailing list archive
help / color / mirror / Atom feedSSL - automatic entry of certificate passphrase in PostgreSQL 10?
4+ messages / 4 participants
[nested] [flat]
* SSL - automatic entry of certificate passphrase in PostgreSQL 10?
@ 2019-12-06 13:25 Martin Goodson <kaemaril@googlemail.com>
2019-12-06 15:22 ` Re: SSL - automatic entry of certificate passphrase in PostgreSQL 10? Tom Lane <tgl@sss.pgh.pa.us>
2019-12-06 21:45 ` Re: SSL - automatic entry of certificate passphrase in PostgreSQL 10? Vasanth Kumar Pediseti <vasanth_pediseti@rediffmail.com>
0 siblings, 2 replies; 4+ messages in thread
From: Martin Goodson @ 2019-12-06 13:25 UTC (permalink / raw)
To: pgsql-admin
Hello.
Apologies if this is an easy one, I've been looking around but clearly
my google-fu may be weak :)
I've recently been asked to enable ssl support on one of our PostgreSQL
10 databases, which I've done. However, the certificate I was given
appears to have been generated using a passphrase, and now during server
start I'm being prompted (as expected) for that passphrase.
I'm concerned that this is going to impact the automatic (re)start of
the database after server shutdowns, crashes etc. I understand that
there is functionality to support this in PostgreSQL 11 with the
ssl_passphrase_command parameter, but I was wondering if there's a way
to emulate this in PostgreSQL 10 or any kind of workaround?
Or am I stuck with either requesting a new certificate without the
passphrase or going to PostgreSQL 11?
For information, it's a PostgreSQL 10.5 cluster hosted on a VM running
RHEL 7.6.
Many thanks!
--
Martin Goodson
In bed above we're deep asleep,
While greater love lies further deep.
This dream must end, the world must know,
We all depend on the beast below.
^ permalink raw reply [nested|flat] 4+ messages in thread
* Re: SSL - automatic entry of certificate passphrase in PostgreSQL 10?
2019-12-06 13:25 SSL - automatic entry of certificate passphrase in PostgreSQL 10? Martin Goodson <kaemaril@googlemail.com>
@ 2019-12-06 15:22 ` Tom Lane <tgl@sss.pgh.pa.us>
2019-12-06 15:38 ` Re: SSL - automatic entry of certificate passphrase in PostgreSQL 10? Magnus Hagander <magnus@hagander.net>
1 sibling, 1 reply; 4+ messages in thread
From: Tom Lane @ 2019-12-06 15:22 UTC (permalink / raw)
To: Martin Goodson <kaemaril@googlemail.com>; +Cc: pgsql-admin
Martin Goodson <kaemaril@googlemail.com> writes:
> Or am I stuck with either requesting a new certificate without the
> passphrase or going to PostgreSQL 11?
AFAIK, those are your options. Pre-v11 there was no reasonable way
to work with a server cert that requires a passphrase.
regards, tom lane
^ permalink raw reply [nested|flat] 4+ messages in thread
* Re: SSL - automatic entry of certificate passphrase in PostgreSQL 10?
2019-12-06 13:25 SSL - automatic entry of certificate passphrase in PostgreSQL 10? Martin Goodson <kaemaril@googlemail.com>
2019-12-06 15:22 ` Re: SSL - automatic entry of certificate passphrase in PostgreSQL 10? Tom Lane <tgl@sss.pgh.pa.us>
@ 2019-12-06 15:38 ` Magnus Hagander <magnus@hagander.net>
0 siblings, 0 replies; 4+ messages in thread
From: Magnus Hagander @ 2019-12-06 15:38 UTC (permalink / raw)
To: Tom Lane <tgl@sss.pgh.pa.us>; +Cc: Martin Goodson <kaemaril@googlemail.com>; pgsql-admin
On Fri, Dec 6, 2019 at 4:22 PM Tom Lane <tgl@sss.pgh.pa.us> wrote:
> Martin Goodson <kaemaril@googlemail.com> writes:
> > Or am I stuck with either requesting a new certificate without the
> > passphrase or going to PostgreSQL 11?
>
> AFAIK, those are your options. Pre-v11 there was no reasonable way
> to work with a server cert that requires a passphrase.
>
It should certainly be possible to remove the passphrase permanently from
the received certificate again, no need for a new one. Well, technically
the passphrase is on the key, and you remove it with something like:
openssl rsa -in current.key -out new.key
That'll ask for a passphrase for the old key, and write the new one out
without.
--
Magnus Hagander
Me: https://www.hagander.net/ <http://www.hagander.net/;
Work: https://www.redpill-linpro.com/ <http://www.redpill-linpro.com/;
^ permalink raw reply [nested|flat] 4+ messages in thread
* Re: SSL - automatic entry of certificate passphrase in PostgreSQL 10?
2019-12-06 13:25 SSL - automatic entry of certificate passphrase in PostgreSQL 10? Martin Goodson <kaemaril@googlemail.com>
@ 2019-12-06 21:45 ` Vasanth Kumar Pediseti <vasanth_pediseti@rediffmail.com>
1 sibling, 0 replies; 4+ messages in thread
From: Vasanth Kumar Pediseti @ 2019-12-06 21:45 UTC (permalink / raw)
To: Martin Goodson <kaemaril@googlemail.com>; +Cc: pgsql-admin
PLEASE STOP SENDING - NOT INTERESTEDFrom: Martin Goodson <kaemaril@googlemail.com>Sent: Fri, 06 Dec 2019 18:55:43To: pgsql-admin <pgsql-admin@postgresql.org>Subject: SSL - automatic entry of certificate passphrase in PostgreSQL 10?Hello.Apologies if this is an easy one, I've been looking around but clearlymy google-fu may be weak :)I've recently been asked to enable ssl support on one of our PostgreSQL10 databases, which I've done. However, the certificate I was givenappears to have been generated using a passphrase, and now during serverstart I'm being prompted (as expected) for that passphrase.I'm concerned that this is going to impact the automatic (re)start ofthe database after server shutdowns, crashes etc. I understand thatthere is functionality to support this in PostgreSQL 11 with thessl_passphrase_command parameter, but I was wondering if there's a wayto emulate this in PostgreSQL 10 or any kind of workaround?Or am I stuck with either requesting a new certificate without thepassphrase or going to PostgreSQL 11?For information, it's a PostgreSQL 10.5 cluster hosted on a VM runningRHEL 7.6.Many thanks!--Martin GoodsonIn bed above we're deep asleep,While greater love lies further deep.This dream must end, the world must know,We all depend on the beast below.
^ permalink raw reply [nested|flat] 4+ messages in thread
end of thread, other threads:[~2019-12-06 21:45 UTC | newest]
Thread overview: 4+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2019-12-06 13:25 SSL - automatic entry of certificate passphrase in PostgreSQL 10? Martin Goodson <kaemaril@googlemail.com>
2019-12-06 15:22 ` Tom Lane <tgl@sss.pgh.pa.us>
2019-12-06 15:38 ` Magnus Hagander <magnus@hagander.net>
2019-12-06 21:45 ` Vasanth Kumar Pediseti <vasanth_pediseti@rediffmail.com>
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox