DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma;
	h=mime-version:sender:in-reply-to:references:date
	:x-google-sender-auth:message-id:subject:from:to:content-type
	:content-transfer-encoding;
	b=SG03nZ7lnsrWSLDHrGuLLFv6nnOZmFmWIwPav1SL3YHFpYNDOwVhkDCDKGNcpF+357
	R8Pe6g8CbcR2mVp516LEP5/Ej2niWP5J7IQHpyeEvR6r0QEN/h8LF66uD9cAq+HWXPXk
	9jBl0Yg7MlNtSyjx7yNSKNf6q+VUP5j2V56sg=
MIME-Version: 1.0
In-Reply-To: <20100416073417.132000@gmx.net>
References: <201004150206.o3F26U427784@momjian.us>
	<20100415074542.137300@gmx.net>
	<j2o9009a4451004151422r4cde72f4o868d4e7017cfab5b@mail.gmail.com>
	<20100416073417.132000@gmx.net>
Date: Fri, 16 Apr 2010 18:08:17 -0300
Message-ID: <j2u9009a4451004161408z294fee70oc32b24e843c09a3@mail.gmail.com>
Subject: Re: PostgreSQL with SSL
From: Jose Berardo <berardo@especializa.com.br>
To: =?ISO-8859-1?Q?Martin_M=FCnstermann?= <mmuenst@gmx.de>,
	pgsql-admin@postgresql.org, Bruce Momjian <bruce@momjian.us>,
	Tom Lane <tgl@sss.pgh.pa.us>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

Hello,

On Fri, Apr 16, 2010 at 4:34 AM, "Martin M=FCnstermann" <mmuenst@gmx.de> wr=
ote:
> Hello.
>
>> > > I'm trying to use the java keytool in place of openssl.
>> > > - I believe that it not possible to start the PostgreSQL server
>> without
>> > > openssl (and ssl-dev package in debian), is it correct?
>> >
>> > Yes, I don't think the java keytool works.
>>
>> Oh, the documentation defeated me twice. The server reads the openssl
>> configuration at start time too.
>> The keytool may be used only to generate the key pair and the certificat=
e,
>> but it can not export the private key from its keystore. You need anothe=
r
>> tool or to write a Java code to do that.
>
> OpenSSL has two ways to store private keys:
> 1. an own proprietary format
> 2. standard PKCS#8
>
> The default as used in the postgresql doc is to produce the proprietary f=
ormat.
> Don't know if PostgreSQL can handle PKCS#8 keys.
>
> If you'd like to check, here is a command to produce PKCS#8:
> openssl pkcs8 -in server.key =A0-out server.p8 -topk8

I've test your suggestion, but it didn't work. Results bellow:

$ Enter PEM pass phrase:
FATAL:  could not load private key file "server.key": problems getting pass=
word

As Tom Laine has explained, the service don't work with encrypted keys
because it would need to ask the administrator for the password (like
above), and would not start until he gives it. The server would need
to keep the clear key in memory for every connection. Anyway, would
still be possible one attacker obtain the key.

>
> Jose, writing a tutorial sounds promising. If I can be of any help, just =
contact me.

Thanks Martin, I'm writing in portuguese, but I will ask a friend for
help me in translation to english.
When it's done, I will send to you. Any consideration will be extreme welco=
me.

>
> Martin
>
> --
> GRATIS f=FCr alle GMX-Mitglieder: Die maxdome Movie-FLAT!
> Jetzt freischalten unter http://portal.gmx.net/de/go/maxdome01
>


--=20
Regards,

Jose Berardo
Especializa Treinamentos
www.especializa.com.br
+55 81 3465.0032