MIME-Version: 1.0
References: <64de784b-8833-e055-3bd4-7420e6675351@eisentraut.org>
In-Reply-To: <64de784b-8833-e055-3bd4-7420e6675351@eisentraut.org>
From: Jacob Champion <jchampion@timescale.com>
Date: Tue, 22 Aug 2023 12:02:02 -0700
Message-ID: <CAAWbhmh8GMZvhGy097cHiy584KUb9ee7Gs0x+gD8+w0hryJW+A@mail.gmail.com>
Subject: Re: Convert encrypted SSL test keys to PKCS#8 format
To: Peter Eisentraut <peter@eisentraut.org>
Cc: pgsql-hackers <pgsql-hackers@postgresql.org>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Archived-At: <https://www.postgresql.org/message-id/CAAWbhmh8GMZvhGy097cHiy584KUb9ee7Gs0x%2BgD8%2Bw0hryJW%2BA%40mail.gmail.com>
Precedence: bulk

On Tue, Aug 22, 2023 at 1:07=E2=80=AFAM Peter Eisentraut <peter@eisentraut.=
org> wrote:
> I have attached two patches, one to update the generation rules, and one
> where I have converted the existing test files.  (I didn't generate them
> from scratch, so for example
> src/test/modules/ssl_passphrase_callback/server.crt that corresponds to
> one of the keys does not need to be updated.)

Looks good from here. I don't have a FIPS setup right now, but the new
files pass tests on OpenSSL 1.0.2u, 1.1.1v, 3.0.2-0ubuntu1.10, and
LibreSSL 3.8. Tests continue to pass after a full clean and rebuild of
the sslfiles.

> It's also interesting that if you generate all private keys from scratch
> using the existing rules on a new OpenSSL version (3+), they will be
> generated in PKCS#8 format by default.  In those OpenSSL versions, the
> openssl-rsa command has a -traditional option to get the old format, but
> of course old OpenSSL versions don't have that.  As OpenSSL 3 gets more
> widespread, we might need to rethink these rules anyway to make sure we
> get consistent behavior.

Yeah. Looks like OpenSSL 3 also adds new v3 extensions to the
certificates... For now they look benign, but I assume someone's going
to run into weirdness at some point.

Thanks!
--Jacob