From: Greg Smith <greg@2ndquadrant.com>
To: pgsql-docs@postgresql.org
Subject: File format for SSL CRL file
Date: Mon, 02 Jul 2012 20:30:07 -0400
Message-ID: <4FF23D0F.80403@2ndquadrant.com> (raw)
A documentation comment came in recently about ssl-tcp.html not
specifying what format is expected for the CRL file. Seems like
something that could be described better now that I look at it, so I'm
passing that along with just wording edits from me; this is from user
"oneironautics":
The root.crl needs to be in PEM (and not DER) format. If a certificate
file exists but is the wrong type, you will be told it cannot find the
file when it exists, with this sort of error in the log:
LOG: SSL certificate revocation list file "root.crl" not found,
skipping: no SSL error reported
DETAIL: Certificates will not be checked against revocation list.
This error can be reported even though you have a root.crl file in
$PGDATA along with the private key and server/root certificates. A
quick check using openssl revealed that the unused CRL file in this
example was indeed in DER format. Converting the certificate to the PEM
format rectified the error:
cd $PGDATA
openssl crl -inform der -in root.crl -outform pem -out root-new.crl
mv root-new.crl root.crl
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-docs@postgresql.org
Cc: greg@2ndquadrant.com
Subject: Re: File format for SSL CRL file
In-Reply-To: <4FF23D0F.80403@2ndquadrant.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox