Date: Thu, 18 Jan 2018 10:25:03 +0900
From: Michael Paquier <michael.paquier@gmail.com>
To: Bruce Momjian <bruce@momjian.us>
Cc: PostgreSQL-documentation <pgsql-docs@postgresql.org>,
	Stephen Frost <sfrost@snowman.net>,
	David Steele <david@pgmasters.net>
Subject: Re: Correction of intermediate certificate handling
Message-ID: <20180118012503.GB29962@paquier.xyz>
References: <20180116002238.GC12724@momjian.us>
 <20180116053305.GB2212@paquier.xyz>
 <20180116162122.GB1470@momjian.us>
 <20180117000950.GB935@paquier.xyz>
 <20180117032344.GA26285@momjian.us>
 <20180117082000.GA13673@paquier.xyz>
 <20180117123442.GB26285@momjian.us>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha256;
	protocol="application/pgp-signature"; boundary="GID0FwUMdk1T2AWN"
Content-Disposition: inline
In-Reply-To: <20180117123442.GB26285@momjian.us>
Precedence: bulk


--GID0FwUMdk1T2AWN
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Wed, Jan 17, 2018 at 07:34:42AM -0500, Bruce Momjian wrote:
> On Wed, Jan 17, 2018 at 05:20:00PM +0900, Michael Paquier wrote:
> > The succession of commands of commands for the intermediate certificates
> > is wild. Could it be possible to explain what each command means? Users
> > would not get lost this way.
>=20
> Yes, I was not happy about that either.  I was afraid that pound-sign
> comments would look like root prompts but I just added them and they
> look fine.  Updated patch attached, with some expiration and wording
> adjustments.  There is also a new paragraph at the end explaining where
> to place the files.

Thanks, that's a net improvement. So +1 for this version.

+    enterprise-wide root <acronym>CAs</acronym>) should be used in product=
ion.
Nit here. CA should not be plural.

+</programlisting>
+    Then, sign the request with the the key to create a root certificate
+    authority:
You still have a "the the" here.

/etc/ssl/openssl.cnf is not available on macos or Windows, which can
lead to a bit of confusion as I would imagine that people would
copy/paste such commands when testing things. Perhaps it would be worth
mentioning that this path is proper to usual Linux distributions (I can
see it at least on ArchLinux and Debian), with a reference to this
OpenSSL link:=20
https://www.openssl.org/docs/manmaster/man5/config.html

There is as well a set of tiny configuration files in src/test/ssl.
--
Michael

--GID0FwUMdk1T2AWN
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEG72nH6vTowiyblFKnvQgOdbyQH0FAlpf928ACgkQnvQgOdby
QH04rA/+Pj/bHrQoUUJSK748nQBhM5vEj0CESWRk6WP9gYl6sMSrbAWALOfAdD/H
5IaVL0QjLqA+WSgts51ao2JUiNy1ZuLR43x4h/lVbpxyTcjKqnYbLckXaXq6pCfs
B8wNQJQuKlqYk5Am8y1JxeW1ov5ZesTK2quJBfxB2yGYEgpKpXPR0xd1IlxgYzf3
yJZGhHIzZem8xsYBplZY08EM/3maRy5DJg8Og6cVLz/UMKLY+UKhKm2JAZf69dI5
rKLm6gvxYXBquPkCtfw+Hja98z4sNcLAqEGHork9UsbHbcfzxSp7Yk0YQlzIJDBE
FWNDYsCgwZxckwBLtg+TISS8BvrpbrH7VQdBRSmYeAnqkwThd5wuoiFIIAZHISrI
gr+E4orcL1b+QUl1NZPa4DUltIfiVGPMdwQ/EjhhkUdRl/HDY4IyYe2TuzEof+7/
vBlD0IxXpMhw5oq2WIR9tyJzzNB78yqWP0bq+dNlKQxJm213CGJZCejzE5Pdin7i
vd8p5YwsbXE33lxXpW4N9RXX7/uGmCNu145b6IwqgDstlmgMNDuoB36maUBSxrL2
3BpS8t6AXWWVIb+sQjjJeGSYKQljwwjTjeBzgwIAyNRLhPEU+HLDZr4ZEfjwtbUI
ageN1DsdyMflvfXhv72wq1QDYBEVPhY+fHE6wFHBkouqCF8eWmg=
=Ol3s
-----END PGP SIGNATURE-----

--GID0FwUMdk1T2AWN--