Content-Type: text/plain;
	charset=us-ascii
Mime-Version: 1.0 (1.0)
Subject: Re: SSL certificate revocation file will not load
From: John Scalia <jayknowsunix@gmail.com>
In-Reply-To: <23871.1497473425@sss.pgh.pa.us>
Date: Wed, 14 Jun 2017 17:55:22 -0400
Cc: pgsql-admin@postgresql.org
Content-Transfer-Encoding: quoted-printable
Message-Id: <68DC7C40-A815-4F80-924A-45C07A463D55@gmail.com>
References: 
 <CABzCKRCjpiosAEVujuvBN+KOzdaQSJyLuo-TTQdmc98PqcKjNA@mail.gmail.com>
 <23871.1497473425@sss.pgh.pa.us>
To: Tom Lane <tgl@sss.pgh.pa.us>
Precedence: bulk
Sender: pgsql-admin-owner@postgresql.org

Well, it turned out that the CRL was in the wrong format. So, I managed to =
convert it with OpenSSL and it loaded properly. I do have one more question=
... the Treasury Department, which produces these certificates for us, expi=
res all the CRL's in just 6 hours, so does that mean I'd have to do restart=
 on the database each time I got a new one or would a reload work?

Sent from my iPad

> On Jun 14, 2017, at 4:50 PM, Tom Lane <tgl@sss.pgh.pa.us> wrote:
>=20
> John Scalia <jayknowsunix@gmail.com> writes:
>> I've got SSL working without the crl file, but when I set ssl_crl_file to
>> use the one I have, it says FATAL on a restart and no SSL error reported.
>> This is not very helpful.
>=20
> Did you look into the postmaster log?  Experimenting with an intentionally
> corrupted CRL file here, I get log messages along the lines of
>=20
> 2017-06-14 16:45:15.096 EDT [22759] LOG:  parameter "ssl_crl_file" change=
d to "root+client.crl"
> 2017-06-14 16:45:15.102 EDT [22759] LOG:  could not load SSL certificate =
revocation list file "root+client.crl": bad base64 decode
>=20
> The actually useful part of that comes out of OpenSSL, and we don't have
> a lot of control about how specific it is ... but there should be
> *something*.
>=20
>            regards, tom lane


--=20
Sent via pgsql-admin mailing list (pgsql-admin@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-admin