Received: from malur.postgresql.org ([2a02:16a8:dc51::56]) by arkaria.postgresql.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA384:256) (Exim 4.89) (envelope-from ) id 1g1tLc-0006wA-GS for pgsql-hackers@arkaria.postgresql.org; Mon, 17 Sep 2018 13:13:52 +0000 Received: from localhost ([127.0.0.1] helo=malur.postgresql.org) by malur.postgresql.org with esmtp (Exim 4.89) (envelope-from ) id 1g1tLa-0003qy-JB for pgsql-hackers@arkaria.postgresql.org; Mon, 17 Sep 2018 13:13:50 +0000 Received: from makus.postgresql.org ([2001:4800:1501:1::229]) by malur.postgresql.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA384:256) (Exim 4.89) (envelope-from ) id 1g1tLa-0003qd-7p for pgsql-hackers@lists.postgresql.org; Mon, 17 Sep 2018 13:13:50 +0000 Received: from out1-smtp.messagingengine.com ([66.111.4.25]) by makus.postgresql.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA384:256) (Exim 4.89) (envelope-from ) id 1g1tLV-0003Og-Uz for pgsql-hackers@postgresql.org; Mon, 17 Sep 2018 13:13:49 +0000 Received: from compute4.internal (compute4.nyi.internal [10.202.2.44]) by mailout.nyi.internal (Postfix) with ESMTP id 44F9A20FE0; Mon, 17 Sep 2018 09:13:45 -0400 (EDT) Received: from mailfrontend2 ([10.202.2.163]) by compute4.internal (MEProxy); Mon, 17 Sep 2018 09:13:45 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=paquier.xyz; h= cc:content-type:date:from:message-id:mime-version:subject:to :x-me-sender:x-me-sender:x-sasl-enc; s=fm2; bh=1UNNUvnmcg5AIzeiV fj+5UCCKnsw6WrYBEoqURu+HF0=; b=p6DAM08J/vu7EEJtXkMJ0RC8a3FJnpatv k/8q5MuuK0bLXDBdZtJaaUjjkmyb9u+of39u7P0VX88+JV0m11DkW9l07WpJJSGi idkgNAZLI0MIFdcNI0AYwjgQAOpVIv6RqailYz/W+xMBhcdX2ehNZLUuGuaF25Fg ogO752b2RwVfdb0mceNj7ac70/pWcHZg/9O0h33mOUczbCaN8RWQksddSPE296Ae ru9mBvDKr44Yv4+8mWTrkq+AV5s0rfAScI46KYlsopMhXZaNAmgfRD3f7iNaQ7FO F+m++WeNEnLhOoXpVC0XnrIVl2VkBQwlRm114LnHsR75yRqM3xM3w== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:content-type:date:from:message-id :mime-version:subject:to:x-me-sender:x-me-sender:x-sasl-enc; s= fm3; bh=1UNNUvnmcg5AIzeiVfj+5UCCKnsw6WrYBEoqURu+HF0=; b=Ueo/npQf 6+ZAkWsRNFkiA8c4zK9+8CWrS1ITpYRjnRfQ3QpERrTfanwnAcfC108bVKKnKDUd 5zc/VJHE3Kvxc5fCw0VcuOo7ToIpUAc2emPeJ97Oc/t7GpW4OsS85lrpLnZRI5Xd h7FFY1wkUTAruQdl2OXizQWVARLnh9Y+i58NqB0nIEE5hsu73DaazRjmY3/CvvwT ew8FRGLGheX4wOr5YAzFrhTgttA6z2XKBiuuFH/tKCOhz85Vha+9tdw8MHbz76Zc RZlQAHdo+a57pY0u7Hcw5zlglBF+fVvlzP8Fc+8dtGWotZW9tdzxWYCDSWe8OHYO aD3GXek+lpiZpA== X-ME-Proxy: X-ME-Sender: Received: from paquier.xyz (c137162.net61215.cablenet.ne.jp [61.215.137.162]) by mail.messagingengine.com (Postfix) with ESMTPA id 47B7A102DB; Mon, 17 Sep 2018 09:13:43 -0400 (EDT) Date: Mon, 17 Sep 2018 22:13:40 +0900 From: Michael Paquier To: Postgres hackers Cc: Heikki Linnakangas Subject: SSL tests failing with "ee key too small" error on Debian SID Message-ID: <20180917131340.GE31460@paquier.xyz> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="a+b56+3nqLzpiR9O" Content-Disposition: inline List-Id: List-Help: List-Subscribe: List-Post: List-Owner: List-Archive: Precedence: bulk --a+b56+3nqLzpiR9O Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Hi all, On a rather freshly-updated Debian SID server, I am able to see failures for the SSL TAP tests: 2018-09-17 22:00:27.389 JST [13072] LOG: database system is shut down 2018-09-17 22:00:27.506 JST [13082] FATAL: could not load server certificate file "server-cn-only.crt": ee key too small 2018-09-17 22:00:27.506 JST [13082] LOG: database system is shut down 2018-09-17 22:00:27.720 JST [13084] FATAL: could not load server certificate file "server-cn-only.crt": ee key too small Wouldn't it be better to rework the rules used to generate the different certificates and reissue them in the tree? It seems to me that this is just waiting to fail in other platforms as well.. Thanks, -- Michael --a+b56+3nqLzpiR9O Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEG72nH6vTowiyblFKnvQgOdbyQH0FAlufqIQACgkQnvQgOdby QH1Ivw/+LtL/6iPURjZhcF5C3O1eV47wTEH5wCXZW17/EcVMRyIVr9YzfS+XdzTc 9hK2w07g6tUi29OSlNFkNY02f71wE80xoez/InLc8eHt5GtF7MoEzRnvJ5dSMH8c vtr4c+x0zSudc64HJUkMFITDypmVf/imRMnV4XDDUl0/dD2YHTjUrpgJfBXfsV2h je2q75kRNuUpebcId4X+vRuStfLfUjIAJm9zEBs3vz93D/oHFESinOzscqzgiXAt 7jIhhhgvYQyRH+xwr/93+pAxrjxktuH3UkiIwsEkYVxaqNfnvVwxBSCd2bSEcFoV GxEHurn9dPLRm8EaN0t+HJO+k+9AGBydQ/amcJpmej9yjjDs4UOgQ+WGzBxNQN+Z y9sGAumLIxHmH65KHQlflssBku8vESksznxYvd5CsUR2N4qEzUrpBA9NSwlftPi5 EpANkZcabH0zYOOlFv6s5MnWaULTNBbvdfh9O4RCBaKkDWUnPeD0DLadl3l3/W4q JG5rybun4nior3TlhnPDFmHptGw+36Qt7x3YJXtecJlZdb2LGdEqYuJAPSUboe37 fIF8OTea9cpnpEgUQ13VAoYPhbEWnaqRJyeiHtIbFTZ+gR0ecvx4iQY4v/MLPgZl tr5IiHVKriy0QXPlOws0lp7u4Vj15Lsw4Lo8zCkYkxtBmadHgVc= =/bJq -----END PGP SIGNATURE----- --a+b56+3nqLzpiR9O--