From: Daniel Gustafsson <dgustafsson@postgresql.org>
To: pgsql-committers@lists.postgresql.org
Subject: pgsql: Add notBefore and notAfter to SSL cert info display
Date: Fri, 22 Mar 2024 20:30:20 +0000
Message-ID: <E1rnlWu-0058t3-5c@gemulon.postgresql.org> (raw)
Add notBefore and notAfter to SSL cert info display
This adds the X509 attributes notBefore and notAfter to sslinfo
as well as pg_stat_ssl to allow verifying and identifying the
validity period of the current client certificate. OpenSSL has
APIs for extracting notAfter and notBefore, but they are only
supported in recent versions so we have to calculate the dates
by hand in order to make this work for the older versions of
OpenSSL that we still support.
Original patch by Cary Huang with additional hacking by Jacob
and myself.
Author: Cary Huang <cary.huang@highgo.ca>
Co-author: Jacob Champion <jacob.champion@enterprisedb.com>
Co-author: Daniel Gustafsson <daniel@yesql.se>
Discussion: https://postgr.es/m/182b8565486.10af1a86f158715.2387262617218380588@highgo.ca
Branch
------
master
Details
-------
https://git.postgresql.org/pg/commitdiff/6acb0a628eccab8764e0306582c2b7e2a1441b9b
Modified Files
--------------
contrib/sslinfo/Makefile | 2 +-
contrib/sslinfo/meson.build | 1 +
contrib/sslinfo/sslinfo--1.2--1.3.sql | 12 ++++
contrib/sslinfo/sslinfo.c | 95 +++++++++++++++++++++++++++++
contrib/sslinfo/sslinfo.control | 2 +-
doc/src/sgml/monitoring.sgml | 20 ++++++
doc/src/sgml/sslinfo.sgml | 30 +++++++++
src/backend/catalog/system_views.sql | 4 +-
src/backend/libpq/be-secure-openssl.c | 78 +++++++++++++++++++++++
src/backend/utils/activity/backend_status.c | 2 +
src/backend/utils/adt/pgstatfuncs.c | 46 ++++++++------
src/include/catalog/catversion.h | 2 +-
src/include/catalog/pg_proc.dat | 6 +-
src/include/libpq/libpq-be.h | 2 +
src/include/utils/backend_status.h | 3 +
src/test/regress/expected/rules.out | 12 ++--
src/test/ssl/t/001_ssltests.pl | 10 +--
src/test/ssl/t/003_sslinfo.pl | 14 +++++
src/tools/pgindent/typedefs.list | 1 +
19 files changed, 308 insertions(+), 34 deletions(-)
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-committers@postgresql.org
Cc: dgustafsson@postgresql.org, pgsql-committers@lists.postgresql.org
Subject: Re: pgsql: Add notBefore and notAfter to SSL cert info display
In-Reply-To: <E1rnlWu-0058t3-5c@gemulon.postgresql.org>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox