Received: from maia.hub.org (unknown [200.46.204.183])
	by mail.postgresql.org (Postfix) with ESMTP id 1616F633F70
	for <pgsql-admin-postgresql.org@mail.postgresql.org>;
	Mon, 12 Apr 2010 13:36:56 -0300 (ADT)
Received: from mail.postgresql.org ([200.46.204.86])
	by maia.hub.org (mx1.hub.org [200.46.204.183]) (amavisd-maia,
	port 10024) with ESMTP id 55268-03 for
	<pgsql-admin-postgresql.org@mail.postgresql.org>;
	Mon, 12 Apr 2010 16:36:45 +0000 (UTC)
X-Greylist: domain auto-whitelisted by SQLgrey-1.7.6
Received: from mail-wy0-f174.google.com (mail-wy0-f174.google.com
	[74.125.82.174])
	by mail.postgresql.org (Postfix) with ESMTP id 28F1C632E95
	for <pgsql-admin@postgresql.org>; Mon, 12 Apr 2010 13:36:44 -0300 (ADT)
Received: by wyb39 with SMTP id 39so1379873wyb.19
	for <pgsql-admin@postgresql.org>; Mon, 12 Apr 2010 09:36:44 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma;
	h=domainkey-signature:mime-version:received:in-reply-to:references
	:date:received:message-id:subject:from:to:content-type;
	bh=H0/yAZnHgGLRO+34US0Ma20HoB0iowpju9bVOjtROcY=;
	b=UFN/fdUw+0ehX3NGNvZYlLatqBPnI0DjBFZOLW6sD9JA9cva3et1xJiT3fNIokr/pJ
	xy59RSY4FAE8Pj+iWyRaCuaINIcsAO+d3DEJ2M8djrmfIINl9NbhkA1n1Dpod5Ly5928
	QM2fPkEFUeS5Qur/BUAqYvr/NulkAHK6LSJ5w=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma;
	h=mime-version:in-reply-to:references:date:message-id:subject:from:to
	:content-type;
	b=ZftfTIwiYsE5LjOXqYxhe5Ujypgl4xCygkTYuicNg1vh1otqUkYa9iHaoG4yYt+7Rx
	Im+4MFrLOkVMQ4f0sIhipei++DcXoOlOiTzZidqiZx/DU7LxCH/coVvTNakF2mnQ1G1B
	xDl+acrFkNKybs04/nFRKAUSO4aDSqbg4zn0o=
MIME-Version: 1.0
Received: by 10.216.168.135 with HTTP; Mon, 12 Apr 2010 09:36:43 -0700 (PDT)
In-Reply-To: <p2w9009a4451004120935l1204e4b3o5139b2781b441b00@mail.gmail.com>
References: <p2w9009a4451004120935l1204e4b3o5139b2781b441b00@mail.gmail.com>
Date: Mon, 12 Apr 2010 13:36:43 -0300
Received: by 10.216.86.67 with SMTP id v45mr2358783wee.70.1271090203976; Mon,
	12 Apr 2010 09:36:43 -0700 (PDT)
Message-ID: <g2m9009a4451004120936w193ca856kdfd22b3eef7dc589@mail.gmail.com>
Subject: PostgreSQL with SSL
From: Jose Berardo <joseberardo@gmail.com>
To: pgsql-admin@postgresql.org
Content-Type: multipart/alternative; boundary=0016e6db2b1c15e29804840cc0e6
X-Virus-Scanned: Maia Mailguard 1.0.1
X-Spam-Status: No, hits=-1.888 tagged_above=-10 required=5
	tests=BAYES_00=-1.9, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001,
	T_TO_NO_BRKTS_FREEMAIL=0.01
X-Spam-Level: 
X-Archive-Number: 201004/142
X-Sequence-Number: 34236

--0016e6db2b1c15e29804840cc0e6
Content-Type: text/plain; charset=ISO-8859-1

Hi,

I'm new on using SSL in PostgreSQL.

I've created a self-signed certificate using openssl and started the server
with ssl suport.

But I have some question, can you help me?

- There is any parameter to configure the path (and name) to certificate
(server.crt) and private key (server.key) like hba_file or ident_file in
postgresql.conf or any other?

- Is it possible to store the server.key in a ciphered  file with triple-des
and configure the PostgreSQL to use a simetric-key to open it when it's
necessary?
Maybe I'm wrong but my server only works with I plain private key.

I'm trying to use the java keytool in place of openssl.
- I believe that it not possible to start the PostgreSQL server without
openssl (and ssl-dev package in debian), is it correct?

- When I create keys and certificates with keytool, it creates a java
keystore to store everything. I know how to export the certificate but I
don't know how to export the private key and when I use the keytool
certificate, the server crashes with this message:

 FATAL:  could not load server certificate file "server.crt": no start line

Sorry about too many questions, but anyone can help me to understand more
about ssl in PostgreSQL?


-- 
Regards,

Jose Berardo




-- 
Atenciosamente,

Jose Berardo
Especializa Treinamentos
www.especializa.com.br
81 3465.0032

--0016e6db2b1c15e29804840cc0e6
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

<div class=3D"gmail_quote">Hi,<br><br>I&#39;m new on using SSL in PostgreSQ=
L.<br><br>I&#39;ve created a self-signed certificate using openssl and star=
ted the server with ssl suport.<br><br>But I have some question, can you he=
lp me?<br>
<br>- There is any parameter to configure the path (and name) to certificat=
e (server.crt) and private key (server.key) like hba_file or ident_file in =
postgresql.conf or any other?<br>
<br>- Is it possible to store the server.key in a ciphered=A0 file with tri=
ple-des and configure the PostgreSQL to use a simetric-key to open it when =
it&#39;s necessary?<br>Maybe I&#39;m wrong but my server only works with I =
plain private key.<br>

<br>I&#39;m trying to use the java keytool in place of openssl.<br>- I beli=
eve that it not possible to start the PostgreSQL server without openssl (an=
d ssl-dev package in debian), is it correct?<br><br>- When I create keys an=
d certificates with keytool, it creates a java keystore to store everything=
. I know how to export the certificate but I don&#39;t know how to export t=
he private key and when I use the keytool certificate, the server crashes w=
ith this message:<br>

<br>=A0FATAL:=A0 could not load server certificate file &quot;server.crt&qu=
ot;: no start line<br><br>Sorry about too many questions, but anyone can he=
lp me to understand more about ssl in PostgreSQL?<br><br clear=3D"all"><br>=
-- <br>

Regards,<br><font color=3D"#888888"><br>Jose Berardo<br><br>
</font></div><br><br clear=3D"all"><br>-- <br>Atenciosamente,<br><br>Jose B=
erardo<br>Especializa Treinamentos<br><a href=3D"http://www.especializa.com=
.br">www.especializa.com.br</a><br>81 3465.0032<br>

--0016e6db2b1c15e29804840cc0e6--