Date: Wed, 17 Jan 2018 09:09:50 +0900
From: Michael Paquier <michael.paquier@gmail.com>
To: Bruce Momjian <bruce@momjian.us>
Cc: PostgreSQL-documentation <pgsql-docs@postgresql.org>,
	Stephen Frost <sfrost@snowman.net>,
	David Steele <david@pgmasters.net>
Subject: Re: Correction of intermediate certificate handling
Message-ID: <20180117000950.GB935@paquier.xyz>
References: <20180116002238.GC12724@momjian.us>
 <20180116053305.GB2212@paquier.xyz>
 <20180116162122.GB1470@momjian.us>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha256;
	protocol="application/pgp-signature"; boundary="rS8CxjVDS/+yyDmU"
Content-Disposition: inline
In-Reply-To: <20180116162122.GB1470@momjian.us>
Precedence: bulk


--rS8CxjVDS/+yyDmU
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Tue, Jan 16, 2018 at 11:21:22AM -0500, Bruce Momjian wrote:
> On Tue, Jan 16, 2018 at 02:33:05PM +0900, Michael Paquier wrote:
> > This bit is important. I am happy that your patch mentions that
> > intermediate certificates avoid the need to store root ones on the
> > client. Should the docs mention terms like "chain of trust"?
>=20
> I think the question is how much do we want to "teach" people in our
> docs.  We do oddly but wisely link from our docs to HP OpenVMS docs
> about how the chain of trust works:
>=20
> 	http://h41379.www4.hpe.com/doc/83final/ba554_90007/ch04s02.html
>=20
> I will write up a paragraph about the concepts for our docs for the
> group's review.

As a separate patch, I think that it would be fine as well.

> > Perhaps the docs could also include an example of command to create a
> > root and an intermediate certificate in runtime.sgml or such?
>=20
> Yes, I have thought about that.  My presentation has clear examples that
> we can use, again based on Stephen and David's scripts using v3_ca.  I
> will work up a possible patch for that too.

That too.

> > On top of that, src/test/ssl does not provide any kind of coverage for
> > that. It would be an area of improvement for those tests.
>=20
> Wow, I have no idea how to do that.  Let me look.  Seems I have more
> work to do.

You would need to update src/test/ssl/Makefile to generate those
intermediate CAs, and then make ServerSetup::switch_server_cert smarter
in the way the series of certificates are handled. A suggestion I have
would be to create each certificate file separately and change the
routine so as it uses an array in input, the order of the items defining
what's the order the the data. For the client there is sslrootcert, so I
guess that a small routine able to take a set of certs and append them
to a single file would make it as well (switch_server_cert should use
it).

> Instead of appending to this doc patch, I will work on a second one for
> review.

I see nothing pressing here. If you are not familiar with the TAP test
facility, this could give you a good introduction to it.
--
Michael

--rS8CxjVDS/+yyDmU
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAABCAAdFiEEG72nH6vTowiyblFKnvQgOdbyQH0FAlpelE4ACgkQnvQgOdby
QH3tzBAAjN9Y9Fnm7+MLNnB6P+IwjTnoqUqvzlu9Qa4tkDYuZl8BzurfFvly77QN
OsS3C+YXb9D5uxEPvPzt9GE3ioGDCD115mzAMDy9Ne2kKnHK8gir+20d8sewxnzz
ZxEpwa8DUseonb63TwtXJ5S82jC2ofkxsa8KQKW7Ji4r/0Aumt0/w+/+ia0lOxYS
VrbMi0gkgZ90ebpTPV843u5Q5BiwIJbgQn/KTmuUe+OR/v/W9pacURLidC36EXv2
LDI56FPMvwEYSwrb/06ZteADBYuD08ZOUfCmWYp8so8BzWK28UzCquIRa0K83Ach
ztq1wsJKdqh3paugpDOL5kq5yRYP5FAqomkMgH24wfjNnTj7Taan6zwSaQPjwbOf
4D6fSZQKQuJEepEFsQJXHfcty8OhoQYdLr3akVD8/OBs+s7K8xf79a/mbMYxAGAZ
BUZfSt1kgznXIa9FVsOKLci3jOPvoOjk+Pu22aJlLyM+1wJGMdlSAWX1XOPiKRLp
QiyfTlO4Szbi43in6IAktUHbLFwIOuiabansJkUBpuKskcrZkL/XIIkAngnKwpR2
XNpLMa0zgpSLZE0HBlyuiJZbc4bfGTQvf1TUNi4i8ZUfQVmfcQlBx++OwIOt8Zt0
tp1RWUFTQMS/btIHZ4nQ9/dbcGdTU5uFN6Zj4/TVXD0d2Xm8fFM=
=UIv7
-----END PGP SIGNATURE-----

--rS8CxjVDS/+yyDmU--