pg.ddx.io pgsql-docs@postgresql.org mailing list archive
help / color / mirror / Atom feedhba_conf hostssl clientcert=1 no longer required in 9.4
6+ messages / 3 participants
[nested] [flat]
* hba_conf hostssl clientcert=1 no longer required in 9.4
@ 2016-07-13 11:03 srix55@gmail.com
2016-07-14 17:30 ` Re: hba_conf hostssl clientcert=1 no longer required in 9.4 Tom Lane <tgl@sss.pgh.pa.us>
0 siblings, 1 reply; 6+ messages in thread
From: srix55@gmail.com @ 2016-07-13 11:03 UTC (permalink / raw)
To: pgsql-docs
The following documentation comment has been logged on the website:
Page: https://www.postgresql.org/docs/9.4/static/ssl-tcp.html
Description:
17.9.1. Using Client Certificates
(https://www.postgresql.org/docs/9.4/static/ssl-tcp.html)
The first paragraph contains this line "...and set the clientcert parameter
to 1 on the appropriate hostssl line(s) in pg_hba.conf" which isn't right
for 9.4.
--
Sent via pgsql-docs mailing list (pgsql-docs@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-docs
^ permalink raw reply [nested|flat] 6+ messages in thread
* Re: hba_conf hostssl clientcert=1 no longer required in 9.4
2016-07-13 11:03 hba_conf hostssl clientcert=1 no longer required in 9.4 srix55@gmail.com
@ 2016-07-14 17:30 ` Tom Lane <tgl@sss.pgh.pa.us>
0 siblings, 0 replies; 6+ messages in thread
From: Tom Lane @ 2016-07-14 17:30 UTC (permalink / raw)
To: srix55@gmail.com; +Cc: pgsql-docs
srix55@gmail.com writes:
> The following documentation comment has been logged on the website:
> Page: https://www.postgresql.org/docs/9.4/static/ssl-tcp.html
> Description:
> 17.9.1. Using Client Certificates
> (https://www.postgresql.org/docs/9.4/static/ssl-tcp.html)
> The first paragraph contains this line "...and set the clientcert parameter
> to 1 on the appropriate hostssl line(s) in pg_hba.conf" which isn't right
> for 9.4.
Hmm, what do you think isn't right about it?
ISTM there's an omission here, which is that it'd be useful to mention
that clientcert=1 is assumed for the "cert" authentication method. But
the text seems okay as far as it goes.
regards, tom lane
--
Sent via pgsql-docs mailing list (pgsql-docs@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-docs
^ permalink raw reply [nested|flat] 6+ messages in thread
* Re: hba_conf hostssl clientcert=1 no longer required in 9.4
@ 2016-07-15 03:38 Srikanth Venkatesh <srix55@gmail.com>
2016-07-15 13:03 ` Re: hba_conf hostssl clientcert=1 no longer required in 9.4 Tom Lane <tgl@sss.pgh.pa.us>
0 siblings, 1 reply; 6+ messages in thread
From: Srikanth Venkatesh @ 2016-07-15 03:38 UTC (permalink / raw)
To: Tom Lane <tgl@sss.pgh.pa.us>; +Cc: pgsql-docs
I guess it should mention that setting the parameter to 1 is no longer
required... and that the default is 1 for "cert".
On Thu, Jul 14, 2016 at 11:00 PM, Tom Lane <tgl@sss.pgh.pa.us> wrote:
> srix55@gmail.com writes:
> > The following documentation comment has been logged on the website:
> > Page: https://www.postgresql.org/docs/9.4/static/ssl-tcp.html
> > Description:
>
> > 17.9.1. Using Client Certificates
> > (https://www.postgresql.org/docs/9.4/static/ssl-tcp.html)
>
> > The first paragraph contains this line "...and set the clientcert
> parameter
> > to 1 on the appropriate hostssl line(s) in pg_hba.conf" which
> isn't right
> > for 9.4.
>
> Hmm, what do you think isn't right about it?
>
> ISTM there's an omission here, which is that it'd be useful to mention
> that clientcert=1 is assumed for the "cert" authentication method. But
> the text seems okay as far as it goes.
>
> regards, tom lane
>
^ permalink raw reply [nested|flat] 6+ messages in thread
* Re: hba_conf hostssl clientcert=1 no longer required in 9.4
2016-07-15 03:38 Re: hba_conf hostssl clientcert=1 no longer required in 9.4 Srikanth Venkatesh <srix55@gmail.com>
@ 2016-07-15 13:03 ` Tom Lane <tgl@sss.pgh.pa.us>
2016-07-16 05:44 ` Re: hba_conf hostssl clientcert=1 no longer required in 9.4 Srikanth Venkatesh <srix55@gmail.com>
0 siblings, 1 reply; 6+ messages in thread
From: Tom Lane @ 2016-07-15 13:03 UTC (permalink / raw)
To: Srikanth Venkatesh <srix55@gmail.com>; +Cc: pgsql-docs
Srikanth Venkatesh <srix55@gmail.com> writes:
> I guess it should mention that setting the parameter to 1 is no longer
> required... and that the default is 1 for "cert".
In what way is it no longer required? Without that flag set, there's
no insistence on a validated client cert.
regards, tom lane
--
Sent via pgsql-docs mailing list (pgsql-docs@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-docs
^ permalink raw reply [nested|flat] 6+ messages in thread
* Re: hba_conf hostssl clientcert=1 no longer required in 9.4
2016-07-15 03:38 Re: hba_conf hostssl clientcert=1 no longer required in 9.4 Srikanth Venkatesh <srix55@gmail.com>
2016-07-15 13:03 ` Re: hba_conf hostssl clientcert=1 no longer required in 9.4 Tom Lane <tgl@sss.pgh.pa.us>
@ 2016-07-16 05:44 ` Srikanth Venkatesh <srix55@gmail.com>
2016-07-16 18:14 ` Re: hba_conf hostssl clientcert=1 no longer required in 9.4 Tom Lane <tgl@sss.pgh.pa.us>
0 siblings, 1 reply; 6+ messages in thread
From: Srikanth Venkatesh @ 2016-07-16 05:44 UTC (permalink / raw)
To: Tom Lane <tgl@sss.pgh.pa.us>; +Cc: pgsql-docs
So, one has to use "cert clientcert=1" and not just "cert" in hba_conf? So
"clientcert" is an auth-method option of "cert"? That isn't exactly clear
in the hba_conf documentation -
https://www.postgresql.org/docs/9.4/static/auth-methods.html#AUTH-CERT .
That part of the document doesn't mention what you just said.
On Fri, Jul 15, 2016 at 6:33 PM, Tom Lane <tgl@sss.pgh.pa.us> wrote:
> Srikanth Venkatesh <srix55@gmail.com> writes:
> > I guess it should mention that setting the parameter to 1 is no longer
> > required... and that the default is 1 for "cert".
>
> In what way is it no longer required? Without that flag set, there's
> no insistence on a validated client cert.
>
> regards, tom lane
>
^ permalink raw reply [nested|flat] 6+ messages in thread
* Re: hba_conf hostssl clientcert=1 no longer required in 9.4
2016-07-15 03:38 Re: hba_conf hostssl clientcert=1 no longer required in 9.4 Srikanth Venkatesh <srix55@gmail.com>
2016-07-15 13:03 ` Re: hba_conf hostssl clientcert=1 no longer required in 9.4 Tom Lane <tgl@sss.pgh.pa.us>
2016-07-16 05:44 ` Re: hba_conf hostssl clientcert=1 no longer required in 9.4 Srikanth Venkatesh <srix55@gmail.com>
@ 2016-07-16 18:14 ` Tom Lane <tgl@sss.pgh.pa.us>
0 siblings, 0 replies; 6+ messages in thread
From: Tom Lane @ 2016-07-16 18:14 UTC (permalink / raw)
To: Srikanth Venkatesh <srix55@gmail.com>; +Cc: pgsql-docs
Srikanth Venkatesh <srix55@gmail.com> writes:
> So, one has to use "cert clientcert=1" and not just "cert" in hba_conf? So
> "clientcert" is an auth-method option of "cert"? That isn't exactly clear
> in the hba_conf documentation -
> https://www.postgresql.org/docs/9.4/static/auth-methods.html#AUTH-CERT .
> That part of the document doesn't mention what you just said.
That's exactly not what I said.
I've tried to clarify this at
https://git.postgresql.org/gitweb/?p=postgresql.git;a=commitdiff;h=745513c70282180afd83c666e43bdb0b6...
regards, tom lane
--
Sent via pgsql-docs mailing list (pgsql-docs@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-docs
^ permalink raw reply [nested|flat] 6+ messages in thread
end of thread, other threads:[~2016-07-16 18:14 UTC | newest]
Thread overview: 6+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2016-07-13 11:03 hba_conf hostssl clientcert=1 no longer required in 9.4 srix55@gmail.com
2016-07-14 17:30 ` Tom Lane <tgl@sss.pgh.pa.us>
2016-07-15 03:38 Re: hba_conf hostssl clientcert=1 no longer required in 9.4 Srikanth Venkatesh <srix55@gmail.com>
2016-07-15 13:03 ` Tom Lane <tgl@sss.pgh.pa.us>
2016-07-16 05:44 ` Srikanth Venkatesh <srix55@gmail.com>
2016-07-16 18:14 ` Tom Lane <tgl@sss.pgh.pa.us>
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox