Received: from maia.hub.org (maia-5.hub.org [200.46.204.29]) by mail.postgresql.org (Postfix) with ESMTP id 4AE6F133729E for ; Mon, 1 Nov 2010 13:46:42 -0300 (ADT) Received: from mail.postgresql.org ([200.46.204.86]) by maia.hub.org (mx1.hub.org [200.46.204.29]) (amavisd-maia, port 10024) with ESMTP id 16786-09 for ; Mon, 1 Nov 2010 16:46:35 +0000 (UTC) X-Greylist: from auto-whitelisted by SQLgrey-1.7.6 Received: from sss.pgh.pa.us (sss.pgh.pa.us [66.207.139.130]) by mail.postgresql.org (Postfix) with ESMTP id B6ECE1337B92 for ; Mon, 1 Nov 2010 13:46:34 -0300 (ADT) Received: from sss2.sss.pgh.pa.us (tgl@localhost [127.0.0.1]) by sss.pgh.pa.us (8.14.2/8.14.2) with ESMTP id oA1GkXt3022759; Mon, 1 Nov 2010 12:46:33 -0400 (EDT) To: Ray Stell cc: pgsql-admin@postgresql.org Subject: Re: ssl client cert authentication In-reply-to: <20101101161426.GA12503@cns.vt.edu> References: <20101101161426.GA12503@cns.vt.edu> Comments: In-reply-to Ray Stell message dated "Mon, 01 Nov 2010 12:14:26 -0400" Date: Mon, 01 Nov 2010 12:46:33 -0400 Message-ID: <22758.1288629993@sss.pgh.pa.us> From: Tom Lane X-Virus-Scanned: Maia Mailguard 1.0.1 X-Spam-Status: No, hits=-1.91 tagged_above=-10 required=5 tests=BAYES_00=-1.9, T_RP_MATCHES_RCVD=-0.01 X-Spam-Level: X-Archive-Number: 201011/6 X-Sequence-Number: 35972 Ray Stell writes: > Someone asked about ssl client cert auth recently. I got > this to work, but something tripped me up. > http://developer.postgresql.org/pgdocs/postgres/ssl-tcp.html > states (very clearly, btw) that, "To require the client to supply a > trusted certificate, place certificates of the certificate authorities > (CAs) you trust in the file root.crt in the data directory." I had > ASS-U-MEd that root.crt would go in .postgresql as it does for encryption. > This begs the question, why two copies of the same file? The one in ~/.postgresql is for client usage. The one in $PGDATA is for the server's use. There's no reason to assume they'd be the same. regards, tom lane