Date: Tue, 16 Jan 2018 14:33:05 +0900
From: Michael Paquier <michael.paquier@gmail.com>
To: Bruce Momjian <bruce@momjian.us>
Cc: PostgreSQL-documentation <pgsql-docs@postgresql.org>,
	Stephen Frost <sfrost@snowman.net>,
	David Steele <david@pgmasters.net>
Subject: Re: Correction of intermediate certificate handling
Message-ID: <20180116053305.GB2212@paquier.xyz>
References: <20180116002238.GC12724@momjian.us>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha256;
	protocol="application/pgp-signature"; boundary="Y7xTucakfITjPcLV"
Content-Disposition: inline
In-Reply-To: <20180116002238.GC12724@momjian.us>
Precedence: bulk


--Y7xTucakfITjPcLV
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Mon, Jan 15, 2018 at 07:22:38PM -0500, Bruce Momjian wrote:
> I asked Stephen Frost and David Steele for details on the arcane art of
> SSL certificate creation.  They showed me scripts they use and explained
> that they properly pass intermediate certificates to clients.  The trick
> was to use the v3_ca extension when creating root and intermediate
> certificates.
>=20
> My talk documents this behavior.  In this talk:
>=20
> 	https://momjian.us/main/writings/pgsql/tls.pdf
>=20
> slide 47 and 49 use -extensions v3_ca.  Slides 73 and 74 show that the
> intermediate is not needed on the client if it is created with v3_ca and
> exist on the server.  Slide 75 shows that the server certificate must be
> first in server.crt.
>=20
> I have created the attached doc patch to add this information to our
> docs.  I would like to backpatch this since what we have now, while it
> works, is inaccurate.

I have spent some time looking at your patch, this gets a +1 from here.

This bit is important. I am happy that your patch mentions that
intermediate certificates avoid the need to store root ones on the
client. Should the docs mention terms like "chain of trust"?

Perhaps the docs could also include an example of command to create a
root and an intermediate certificate in runtime.sgml or such?

On top of that, src/test/ssl does not provide any kind of coverage for
that. It would be an area of improvement for those tests.
--
Michael

--Y7xTucakfITjPcLV
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAABCAAdFiEEG72nH6vTowiyblFKnvQgOdbyQH0FAlpdjpEACgkQnvQgOdby
QH03rQ//eV9pxA2gxBPVA3k2J7yEpKz4sKJw+Xam8wVi2TeqKnJ6eqcXkwXWE+Mt
eylCWlmCYLYZ3XzkZM/LpJylMyxKg1YRhvuoePJhQGyhmo+n9UACap8vjlCqhtoJ
EgCTLDQEGLCVllCeOk5khfM/TOpQ2AQ64eFawoU0xqJwV7gWu3BcIid9FBaop6oq
dOnApAgmrvHKrXr+JLTvJLtKL0Q79BCGpzqOiPzv4xI10tLZ3igR1F/+O4Rc5aEi
JqQDX+Yv5esYcO1QSZd9MowfwZQCD+QgrKqFTTbWHLH6IlAC8g/9yATUe1HG6vaN
jmIS25IkLQLkFwRM8R5I/Y3tJS+Y930f9Xtu9ruNU+q1hU0LEQjZWLmwkFI9LLW+
OSbQuMGWdriKviq5k4jAgI3ofyHcE9cMF8DDmLyDI1lwHJaeRJXMP7Mx5J4hDNL2
eaJ1isObXMmYknt44waM1w+rb3E3XezVZUqUANfHts43EyfzNqFQhpwRH0+7Imly
1K4h2x88IQ8UG6MjK1wyHP8s+gwPL0Q62nBfJru4jicn/1J3UNsQyZiPZ65SO+W4
c0s9dAH6T6pw98FBTYzvSPZdjx/muRDF4zIXT4RguzSg2p9Sdy3q1NIASzHiJ3jU
XP+YLCTbsQ1PoRY2Pr/Qan2LcFXoQe4T2YwSGji1YpJGHNkGZgo=
=xrja
-----END PGP SIGNATURE-----

--Y7xTucakfITjPcLV--