Content-Type: text/plain;
	charset=utf-8
Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3696.100.31\))
Subject: Re: [PATCH] Log details for client certificate failures
From: Graham Leggett <minfrin@sharp.fm>
In-Reply-To: 
 <CAAWbhmiKmsRhMCvGqjyNrb-eSivgK2UtH8DOMZ3E-2Zu9Lu-LQ@mail.gmail.com>
Date: Sat, 9 Jul 2022 15:49:34 +0200
Cc: Peter Eisentraut <peter.eisentraut@enterprisedb.com>,
 PostgreSQL-development <pgsql-hackers@postgresql.org>
Content-Transfer-Encoding: quoted-printable
Message-Id: <59BF2A64-05F6-4870-B7DB-3FE815682209@sharp.fm>
References: <c60a8948-00a0-147d-75df-62699193371f@enterprisedb.com>
 <6EE6999E-0174-4B74-AC70-BE13F53E6827@sharp.fm>
 <CAAWbhmiKmsRhMCvGqjyNrb-eSivgK2UtH8DOMZ3E-2Zu9Lu-LQ@mail.gmail.com>
To: Jacob Champion <jchampion@timescale.com>
Archived-At: 
 <https://www.postgresql.org/message-id/59BF2A64-05F6-4870-B7DB-3FE815682209%40sharp.fm>
Precedence: bulk

On 01 Jul 2022, at 22:59, Jacob Champion <jchampion@timescale.com> =
wrote:

>> I added this to httpd a while back:
>>=20
>> SSL_CLIENT_CERT_RFC4523_CEA
>>=20
>> It would be good to interoperate.
>=20
> What kind of interoperation did you have in mind? Are there existing
> tools that want to scrape this information for observability?

This is for human troubleshooting.

> I think the CEA syntax might not be a good fit for this particular
> patch: first, we haven't actually verified the certificate, so no one
> should be using it to assert certificate equality (and I'm truncating
> the Issuer anyway, to avoid letting someone flood the logs). Second,
> this is designed to be human-readable rather than machine-readable.

This is what a CEA looks like:

{ serialNumber 400410167207191393705333222102472642510002355884, issuer =
rdnSequence:=E2=80=9DCN=3DFoo UK G1,O=3DFoo,C=3DUK" }

Whitespace and escaping is important above.

When troubleshooting, you want a string like the above that you can cut =
and paste and search for in other systems and log files. The =
verification status of the cert isn=E2=80=99t an issue at this point, =
you have a system in front of you where it doesn=E2=80=99t work when it =
should, and you need to know exactly what=E2=80=99s connecting, not what =
you think you=E2=80=99re connecting to, and you need precise data.

Please don=E2=80=99t invent another format, or try and truncate the =
data. This is a huge headache when troubleshooting.

Regards,
Graham
=E2=80=94