Date: Wed, 17 Jan 2018 17:20:00 +0900
From: Michael Paquier <michael.paquier@gmail.com>
To: Bruce Momjian <bruce@momjian.us>
Cc: PostgreSQL-documentation <pgsql-docs@postgresql.org>,
	Stephen Frost <sfrost@snowman.net>,
	David Steele <david@pgmasters.net>
Subject: Re: Correction of intermediate certificate handling
Message-ID: <20180117082000.GA13673@paquier.xyz>
References: <20180116002238.GC12724@momjian.us>
 <20180116053305.GB2212@paquier.xyz>
 <20180116162122.GB1470@momjian.us>
 <20180117000950.GB935@paquier.xyz>
 <20180117032344.GA26285@momjian.us>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha256;
	protocol="application/pgp-signature"; boundary="HlL+5n6rz5pIUxbD"
Content-Disposition: inline
In-Reply-To: <20180117032344.GA26285@momjian.us>
Precedence: bulk


--HlL+5n6rz5pIUxbD
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Tue, Jan 16, 2018 at 10:23:44PM -0500, Bruce Momjian wrote:
> On Wed, Jan 17, 2018 at 09:09:50AM +0900, Michael Paquier wrote:
> > On Tue, Jan 16, 2018 at 11:21:22AM -0500, Bruce Momjian wrote:
> > > On Tue, Jan 16, 2018 at 02:33:05PM +0900, Michael Paquier wrote:
>=20
> I ended up merging the "chain of trust" changes into the "intermediate"
> patch since they affect adjacent sections of the docs.  You can see this
> as the first attached patch.

Thanks. I looked at crt.diff and the surroundings in the docs. This one
looks consistent to me.

> > > > Perhaps the docs could also include an example of command to create=
 a
> > > > root and an intermediate certificate in runtime.sgml or such?
> > >=20
> > > Yes, I have thought about that.  My presentation has clear examples t=
hat
> > > we can use, again based on Stephen and David's scripts using v3_ca.  I
> > > will work up a possible patch for that too.
> >=20
> > That too.
>=20
> I did that as a separate patch, which is the second attachment.

This is openssl.diff.

+    Then, sign the request with the the private key to create a root
+certificate authority:
s/the the/the/

+<programlisting>
+openssl req -new -nodes -text -out root.csr \
+  -keyout root.key -subj "/CN=3D<replaceable>root.yourdomain.com</replacea=
ble>"
+chmod og-rwx root.key
+openssl x509 -req -in root.csr -text -days 365 \
+  -extfile /etc/ssl/openssl.cnf -extensions v3_ca \
+  -signkey root.key -out root.crt
The succession of commands of commands for the intermediate certificates
is wild. Could it be possible to explain what each command means? Users
would not get lost this way.

> I don't think I will work on the testing changes.

Fine for me. This could do for a fine TODO item. Not one of those hard,
complicated and basically impossible things on the TODO list.
--
Michael

--HlL+5n6rz5pIUxbD
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEG72nH6vTowiyblFKnvQgOdbyQH0FAlpfBzAACgkQnvQgOdby
QH1Diw/+JEof5VDW3vIOwm8CmTpo2l4J4lh3LYVFvsNKDW91nphpLRhxtuFI4yWd
NGRs0yrF+oCloQiMvvaa/UUxiui9AiFwNBKGoTArLkOvGj1Cl57vCc+sVC0VFrVS
wyx95jRhCoywz3tSo7eo985B9C4yvVeLEK3mXdIZMvpzMr0PwlhR0MDHInGyWiey
zpb0ate8to+HKOQ9/toAA5qggCQLP1TfthtyF4ZxgNgv5SNWEzMViIywm4XAAi0R
qolERbsThOHb7dvgVxle3sDy14P+2+hpkFxwYTpf7ir3XHRgs9Q71EwGKQ2LTn5d
n5n7Her0h+xr8cOOXp1EQH/x7+yiOXxkZk0xdfq5O7fNYjuR3dkv72UeTK2vpYEj
2Me044BK99BeVZjNsVD7VuAfBUcOyOE80kPRt36zA9bC9tf/VBvzVavVYkFFl4pJ
h9SnYCrlnhTBK/abxzMzRAsS1ln9amY9z1j6ShswTBYEykHJ4KCiQRUq8Ss5Qzrv
AIAEm0sns4hbbIasYGawEMLO7B/p9eTSbmCIxzaiTaglC0OiDTkuHVwEWSyBl5b0
qphb5vmTgnenqCK/3IeS2eaNkS0UEb+/ZmiBt8luQ2rLsS94YmHyjgcLkBAwdyx7
BHJd0hyjy4Pe4644Gd5cibHUZ7c175SUFU6BnHJncXzHIHqXXc8=
=ZiyW
-----END PGP SIGNATURE-----

--HlL+5n6rz5pIUxbD--