From: Alvaro Herrera <alvherre@commandprompt.com>
To: Greg Smith <greg@2ndquadrant.com>
Cc: Pg Docs <pgsql-docs@postgresql.org>
Cc: Pg Hackers <pgsql-hackers@postgresql.org>
Subject: Re: File format for SSL CRL file
Date: Mon, 02 Jul 2012 22:44:00 -0400
Message-ID: <1341283155-sup-42@alvh.no-ip.org> (raw)
In-Reply-To: <4FF23D0F.80403@2ndquadrant.com>
References: <4FF23D0F.80403@2ndquadrant.com>
Excerpts from Greg Smith's message of lun jul 02 20:30:07 -0400 2012:
> A documentation comment came in recently about ssl-tcp.html not
> specifying what format is expected for the CRL file. Seems like
> something that could be described better now that I look at it, so I'm
> passing that along with just wording edits from me; this is from user
> "oneironautics":
>
> The root.crl needs to be in PEM (and not DER) format. If a certificate
> file exists but is the wrong type, you will be told it cannot find the
> file when it exists, with this sort of error in the log:
>
> LOG: SSL certificate revocation list file "root.crl" not found,
> skipping: no SSL error reported
HEAD is different in this area -- it dies with a FATAL instead of just
skipping it.
Also, the error message seems rather poor. Maybe the code should call
X509_STORE_CTX_get_error() instead of SSLerrmessage (which calls
ERR_get_error; apparently not the right thing to do).
--
Álvaro Herrera <alvherre@commandprompt.com>
The PostgreSQL Company - Command Prompt, Inc.
PostgreSQL Replication, Consulting, Custom Development, 24x7 support
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-docs@postgresql.org
Cc: alvherre@commandprompt.com, greg@2ndquadrant.com, pgsql-hackers@postgresql.org
Subject: Re: File format for SSL CRL file
In-Reply-To: <1341283155-sup-42@alvh.no-ip.org>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox