From: Graham Leggett <minfrin@sharp.fm>
To: Jacob Champion <jchampion@timescale.com>
Cc: Peter Eisentraut <peter.eisentraut@enterprisedb.com>
Cc: PostgreSQL-development <pgsql-hackers@postgresql.org>
Subject: Re: [PATCH] Log details for client certificate failures
Date: Sat, 9 Jul 2022 15:49:34 +0200
Message-ID: <59BF2A64-05F6-4870-B7DB-3FE815682209@sharp.fm> (raw)
In-Reply-To: <CAAWbhmiKmsRhMCvGqjyNrb-eSivgK2UtH8DOMZ3E-2Zu9Lu-LQ@mail.gmail.com>
References: <c60a8948-00a0-147d-75df-62699193371f@enterprisedb.com>
<6EE6999E-0174-4B74-AC70-BE13F53E6827@sharp.fm>
<CAAWbhmiKmsRhMCvGqjyNrb-eSivgK2UtH8DOMZ3E-2Zu9Lu-LQ@mail.gmail.com>
On 01 Jul 2022, at 22:59, Jacob Champion <jchampion@timescale.com> wrote:
>> I added this to httpd a while back:
>>
>> SSL_CLIENT_CERT_RFC4523_CEA
>>
>> It would be good to interoperate.
>
> What kind of interoperation did you have in mind? Are there existing
> tools that want to scrape this information for observability?
This is for human troubleshooting.
> I think the CEA syntax might not be a good fit for this particular
> patch: first, we haven't actually verified the certificate, so no one
> should be using it to assert certificate equality (and I'm truncating
> the Issuer anyway, to avoid letting someone flood the logs). Second,
> this is designed to be human-readable rather than machine-readable.
This is what a CEA looks like:
{ serialNumber 400410167207191393705333222102472642510002355884, issuer rdnSequence:”CN=Foo UK G1,O=Foo,C=UK" }
Whitespace and escaping is important above.
When troubleshooting, you want a string like the above that you can cut and paste and search for in other systems and log files. The verification status of the cert isn’t an issue at this point, you have a system in front of you where it doesn’t work when it should, and you need to know exactly what’s connecting, not what you think you’re connecting to, and you need precise data.
Please don’t invent another format, or try and truncate the data. This is a huge headache when troubleshooting.
Regards,
Graham
—
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: minfrin@sharp.fm, jchampion@timescale.com, peter.eisentraut@enterprisedb.com
Subject: Re: [PATCH] Log details for client certificate failures
In-Reply-To: <59BF2A64-05F6-4870-B7DB-3FE815682209@sharp.fm>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox