Content-Type: text/plain; charset=UTF-8
Cc: Pg Docs <pgsql-docs@postgresql.org>,
	Pg Hackers <pgsql-hackers@postgresql.org>
Subject: Re: File format for SSL CRL file
From: Alvaro Herrera <alvherre@commandprompt.com>
To: Greg Smith <greg@2ndquadrant.com>
In-reply-to: <4FF23D0F.80403@2ndquadrant.com>
References: <4FF23D0F.80403@2ndquadrant.com>
Date: Mon, 02 Jul 2012 22:44:00 -0400
Message-Id: <1341283155-sup-42@alvh.no-ip.org>
User-Agent: Sup/git
Content-Transfer-Encoding: quoted-printable


Excerpts from Greg Smith's message of lun jul 02 20:30:07 -0400 2012:
> A documentation comment came in recently about ssl-tcp.html not=20
> specifying what format is expected for the CRL file.  Seems like=20
> something that could be described better now that I look at it, so I'm=20
> passing that along with just wording edits from me; this is from user=20
> "oneironautics":
>=20
> The root.crl needs to be in PEM (and not DER) format.  If a certificate=
=20
> file exists but is the wrong type, you will be told it cannot find the=20
> file when it exists, with this sort of error in the log:
>=20
> LOG:  SSL certificate revocation list file "root.crl" not found,=20
> skipping: no SSL error reported

HEAD is different in this area -- it dies with a FATAL instead of just
skipping it.

Also, the error message seems rather poor.  Maybe the code should call
X509_STORE_CTX_get_error() instead of SSLerrmessage (which calls
ERR_get_error; apparently not the right thing to do).

--=20
=C3=81lvaro Herrera <alvherre@commandprompt.com>
The PostgreSQL Company - Command Prompt, Inc.
PostgreSQL Replication, Consulting, Custom Development, 24x7 support