From: Jose Berardo <berardo@especializa.com.br>
To: Martin Münstermann <mmuenst@gmx.de>
To: pgsql-admin@postgresql.org, Bruce Momjian <bruce@momjian.us>
To: Tom Lane <tgl@sss.pgh.pa.us>
Subject: Re: PostgreSQL with SSL
Date: Fri, 16 Apr 2010 18:08:17 -0300
Message-ID: <j2u9009a4451004161408z294fee70oc32b24e843c09a3@mail.gmail.com> (raw)
In-Reply-To: <20100416073417.132000@gmx.net>
References: <201004150206.o3F26U427784@momjian.us>
<20100415074542.137300@gmx.net>
<j2o9009a4451004151422r4cde72f4o868d4e7017cfab5b@mail.gmail.com>
<20100416073417.132000@gmx.net>
Hello,
On Fri, Apr 16, 2010 at 4:34 AM, "Martin Münstermann" <mmuenst@gmx.de> wrote:
> Hello.
>
>> > > I'm trying to use the java keytool in place of openssl.
>> > > - I believe that it not possible to start the PostgreSQL server
>> without
>> > > openssl (and ssl-dev package in debian), is it correct?
>> >
>> > Yes, I don't think the java keytool works.
>>
>> Oh, the documentation defeated me twice. The server reads the openssl
>> configuration at start time too.
>> The keytool may be used only to generate the key pair and the certificate,
>> but it can not export the private key from its keystore. You need another
>> tool or to write a Java code to do that.
>
> OpenSSL has two ways to store private keys:
> 1. an own proprietary format
> 2. standard PKCS#8
>
> The default as used in the postgresql doc is to produce the proprietary format.
> Don't know if PostgreSQL can handle PKCS#8 keys.
>
> If you'd like to check, here is a command to produce PKCS#8:
> openssl pkcs8 -in server.key -out server.p8 -topk8
I've test your suggestion, but it didn't work. Results bellow:
$ Enter PEM pass phrase:
FATAL: could not load private key file "server.key": problems getting password
As Tom Laine has explained, the service don't work with encrypted keys
because it would need to ask the administrator for the password (like
above), and would not start until he gives it. The server would need
to keep the clear key in memory for every connection. Anyway, would
still be possible one attacker obtain the key.
>
> Jose, writing a tutorial sounds promising. If I can be of any help, just contact me.
Thanks Martin, I'm writing in portuguese, but I will ask a friend for
help me in translation to english.
When it's done, I will send to you. Any consideration will be extreme welcome.
>
> Martin
>
> --
> GRATIS für alle GMX-Mitglieder: Die maxdome Movie-FLAT!
> Jetzt freischalten unter http://portal.gmx.net/de/go/maxdome01
>
--
Regards,
Jose Berardo
Especializa Treinamentos
www.especializa.com.br
+55 81 3465.0032
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-admin@postgresql.org
Cc: berardo@especializa.com.br, mmuenst@gmx.de, bruce@momjian.us, tgl@sss.pgh.pa.us
Subject: Re: PostgreSQL with SSL
In-Reply-To: <j2u9009a4451004161408z294fee70oc32b24e843c09a3@mail.gmail.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox