pg.ddx.io pgsql-interfaces@postgresql.org mailing list archive
help / color / mirror / Atom feedTo whom an SSL client crt (postgresql.crt) is issued
2+ messages / 2 participants
[nested] [flat]
* To whom an SSL client crt (postgresql.crt) is issued
@ 2005-12-18 15:17 k.p.d.lehre@medisin.uio.no
2005-12-19 06:08 ` Re: To whom an SSL client crt (postgresql.crt) is issued Tom Lane <tgl@sss.pgh.pa.us>
0 siblings, 1 reply; 2+ messages in thread
From: k.p.d.lehre@medisin.uio.no @ 2005-12-18 15:17 UTC (permalink / raw)
To: pgsql-interfaces
Server: pg 8.0.4 on Red Hat Enterprise Linux 4.
Client: psql 8.0.4 on WinXP Pro SP2.
I have a (self-signed) root.crt on the server, and a
%APPDATA%\postgresql\postgresql.crt signed by that root.crt on the client.
I am surprised that it does not seem to matter to whom the postgresql.crt
is issued.
What I experience is not really contradictory to the docs: "... a client
certificate will be requested from the client during SSL connection
startup, and it must have been signed by one of the certificates present
in root.crt". The docs do not mention that the client crt has to be issued
to the user trying to log on. Isn't it a point TO WHOM the client crt is
issued? Is this the way it is meant to be?
Thanks, KP
^ permalink raw reply [nested|flat] 2+ messages in thread
* Re: To whom an SSL client crt (postgresql.crt) is issued
2005-12-18 15:17 To whom an SSL client crt (postgresql.crt) is issued k.p.d.lehre@medisin.uio.no
@ 2005-12-19 06:08 ` Tom Lane <tgl@sss.pgh.pa.us>
0 siblings, 0 replies; 2+ messages in thread
From: Tom Lane @ 2005-12-19 06:08 UTC (permalink / raw)
To: k.p.d.lehre@medisin.uio.no; +Cc: pgsql-interfaces
k.p.d.lehre@medisin.uio.no writes:
> The docs do not mention that the client crt has to be issued
> to the user trying to log on. Isn't it a point TO WHOM the client crt is
> issued? Is this the way it is meant to be?
Restricting that would require assumptions-not-in-evidence about
certificate issuers using names that sync with database user names.
But perhaps more to the point, Postgres does not use SSL certificates
as a user authentication mechanism, only as a transport privacy
mechanism. Using SSL is not sufficient grounds for deciding you
can use "trust" auth mode.
regards, tom lane
^ permalink raw reply [nested|flat] 2+ messages in thread
end of thread, other threads:[~2005-12-19 06:08 UTC | newest]
Thread overview: 2+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2005-12-18 15:17 To whom an SSL client crt (postgresql.crt) is issued k.p.d.lehre@medisin.uio.no
2005-12-19 06:08 ` Tom Lane <tgl@sss.pgh.pa.us>
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox