Content-Type: text/plain;
	charset=us-ascii
Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3696.120.41.1.4\))
Subject: Re: Wrong description in server_ca.config and client_ca.config
From: Daniel Gustafsson <daniel@yesql.se>
In-Reply-To: <12f4c425-45fe-480f-a692-b3ed82ebcb33@highgo.ca>
Date: Wed, 28 Feb 2024 14:29:25 +0100
Cc: Pgsql Hackers <pgsql-hackers@lists.postgresql.org>
Content-Transfer-Encoding: quoted-printable
Message-Id: <9F5D3F4F-EEDE-43F6-BFB2-7918F2946DA4@yesql.se>
References: <12f4c425-45fe-480f-a692-b3ed82ebcb33@highgo.ca>
To: David Zhang <david.zhang@highgo.ca>
Archived-At: <https://www.postgresql.org/message-id/9F5D3F4F-EEDE-43F6-BFB2-7918F2946DA4%40yesql.se>
Precedence: bulk

> On 27 Feb 2024, at 20:38, David Zhang <david.zhang@highgo.ca> wrote:
>=20
> Hi Hackers,
>=20
> The current descriptions for server_ca.config and client_ca.config are =
not so accurate. For example, one of the descriptions in =
server_ca.config states, "This certificate is used to sign server =
certificates. It is self-signed." However, the server_ca.crt and =
client_ca.crt are actually signed by the root_ca.crt, which is the only =
self-signed certificate.

IIRC the intent was to say it isn't signed by an official CA, but I =
agree it's
misleading.

> Therefore, it would be more accurate to change it to "This certificate =
is used to sign server certificates. It is an Intermediate CA."

Agreed.  We should perhaps add the "This certificate is self-signed" =
sentence
to root_ca.conf as well while at it, it's currently only mentioned in
sslfiles.mk and adding it to the config would make the documentation =
more
consistent.

> Attached is a patch attempting to fix the description issue.

Thanks, I'll have another look and will apply.

--
Daniel Gustafsson