SSL certificates issue

From: Asia <asia123321(at)op(dot)pl>
To: pgsql-general(at)postgresql(dot)org
Subject: SSL certificates issue
Date: 2011-08-22 09:21:20
Message-ID: 48475642-4099f9548a41ffcc9859315fc52dff12@pkn5.m5r2.onet
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-general

Recently I have been working on implementation of mutual SSL authentication between our application and PostgreSQL database.
I managed to make it work wih "ssl=true" connection option and "clientcert=1" flags in pg_hba.conf. Moreover I managed to make it work with C++ application using libpq and Java application using postgresql JDBC driver.

The only concern I have is some discrepancy between the way libpq and JDBC works. It seems that libpq is less restrictive than JDBC with standard
built-in SSLSocketFactory.
The following schema describes some information about my certs:

Client Server
postgresql.crt server.crt
postgresql.key server.key
root.crt root.crt

where postgresql.crt is singed by Intermediate CA 1
server.crt is signed by Intermediate CA 2
Intermediate CA 1 and Intermediate CA 2 are chain certs both singed by the same root certificate
root.crt - root certificate that signed Intermediate CA1 and Intermediate CA 2 (which was enough for libpq but not enough for JDBC)

Now the issue is then when using libpq it was enough to have only root certificate in server's root.crt and it worked fine.
But when I tried using the same with JDBC it turned out that I need to put whole chain (2 certs) of Intermediate CA 1 in server's root.crt.

All I need is the confirmation whether this is working as designed or this is possibly libpq bug?

Kind Regards,
Joanna

Responses

Browse pgsql-general by date

  From Date Subject
Next Message alexondi 2011-08-22 12:11:08 Error with "pg_filenode.map" file
Previous Message Condor 2011-08-22 08:40:04 securing the sql server ?