Message-ID: <4DC5895A.5050207@kerneljack.com>
Date: Sat, 07 May 2011 19:03:06 +0100
From: Khusro Jaleel <mailing-lists@kerneljack.com>
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US;
	rv:1.9.2.17) Gecko/20110428 Fedora/3.1.10-1.fc14 Thunderbird/3.1.10
MIME-Version: 1.0
To: pgsql-docs@postgresql.org
Subject: Re: Error in SSL config documentation?
References: <4DC575F6.4060508@kerneljack.com>
	<BANLkTim+=1zT5=4y-ymjAyREvZ5LBX0Fcw@mail.gmail.com>
In-Reply-To: <BANLkTim+=1zT5=4y-ymjAyREvZ5LBX0Fcw@mail.gmail.com>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit

On 07/05/11 18:46, Magnus Hagander wrote:

> clientcert=1 makes the server request a client certificate - but does
> not use it for authentication. So the client just has to present *any
> valid* client certificate, and can then use whatever other
> authenticaiton method is specified (md5, ldap, etc).

Ah, I see now. When you wrote "clientcert=1" above, that made me realise 
that I was making a mistake. I was using "clientcert" in the 
authentication method column, and you can't use it there because it's an 
"option" to "any other auth method" and not a auth method on its own.

I did read the doc and this was not clear to me at first, so perhaps it 
could be made clearer?

Thanks for your help,
Khusro