pg.ddx.io  pgsql-docs@postgresql.org mailing list archive  

help / color / mirror / Atom feed

From: Bruce Momjian <bruce@momjian.us>
To: PostgreSQL-documentation <pgsql-docs@postgresql.org>
Subject: Openssl v3_ca
Date: Mon, 24 Aug 2020 13:56:53 -0400
Message-ID: <20200824175653.GA32411@momjian.us> (raw)

A few years ago I figured out how to create intermediate certificates
that are transferred across OpenSSL connections by using the v3_ca
extension, and added this to the PG documentation.

I have now just figured out that v3_ca is just a heading in the openssl
configuration file, e.g., /etc/ssl/openssl.cnf, and that it is
specifically this line that enables this to work:

	basicConstraints = critical,CA:true

I have created the attached documentation patch to clarify exactly what
is needed, in case non-openssl tools are used.

-- 
  Bruce Momjian  <bruce@momjian.us>        https://momjian.us
  EnterpriseDB                             https://enterprisedb.com

  The usefulness of a cup is in its emptiness, Bruce Lee

Attachments:

v3_ca.diff (text/x-diff, 689B) download
diff --git a/doc/src/sgml/runtime.sgml b/doc/src/sgml/runtime.sgml
index c8698898f3..f705c4fec1 100644
--- a/doc/src/sgml/runtime.sgml
+++ b/doc/src/sgml/runtime.sgml
@@ -2194,7 +2194,8 @@ pg_dumpall -p 5432 | psql -d postgres -p 5433
    can also be appended to the file.  Doing this avoids the necessity of
    storing intermediate certificates on clients, assuming the root and
    intermediate certificates were created with <literal>v3_ca</literal>
-   extensions.  This allows easier expiration of intermediate certificates.
+   extensions (which sets <literal>CA:TRUE</literal> on certificates).
+   This allows easier expiration of intermediate certificates.
   </para>
 
   <para>

view thread (4+ messages)  latest in thread

Message-ID: <20200824175653.GA32411@momjian.us>
Permalink:  ../20200824175653.GA32411@momjian.us/
Also on:    postgresql.org/message-id/20200824175653.GA32411@momjian.us

copy link · copy postgr.es · copy git am

reply

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: pgsql-docs@postgresql.org
  Cc: bruce@momjian.us
  Subject: Re: Openssl v3_ca
  In-Reply-To: <20200824175653.GA32411@momjian.us>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox