SSL root.crt read problem for Postgres 8.4

From: Michael Swierczek <mike(dot)swierczek(at)gmail(dot)com>
To: PostgreSQL Novice <pgsql-novice(at)postgresql(dot)org>
Subject: SSL root.crt read problem for Postgres 8.4
Date: 2009-07-23 19:00:46
Message-ID: 68b5b5880907231200y467a67a2q3ab1cf013c529db0@mail.gmail.com
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-novice

We're running PostgreSQL 8.3.5 on Windows in production (and it's a
spectacular piece of software) and we have 8.3.5 and 8.4 on Windows in
our testing environments. I've created a Certificate Authority
root.crt root certificate (internal to the company) and used it to
sign a server.key and server.crt file. All of the openssl commands I
ran (using openssl on Cygwin) to create a key used -newkey rsa:2048 as
an option. The resulting root.crt file and server.crt file can (and
have) been installed in the normal Windows certificate store - so at
least Windows Vista finds the format acceptable.

In PostgreSQL 8.3.5, I modified postgresql.conf and set ssl=on and
ssl_ciphers = ALL. I modified pg_hba.conf to have all of the
connections as "hostssl all all 192.168._._/16 md5". (obviously
replacing _._ with the IP of each machine that could connect). I put
root.crt, server.key, and server.crt into the 8.3.5 data directory.
When I restart the pgsql-8.3 service, it starts fine. I can connect
normally through SSL with psql, pgAdmin3, and JDBC from any of the
allowed pg_hba entries.

On the exact same server, I stop PostgreSQL 8.3.5 (pgsql-8.3 service).
I copy the same pg_hba.conf and postgresql.conf settings to the
PostgreSQL 8.4 installation. I copy the same root.crt, server.key,
and server.crt files into the PostgreSQL 8.4 data directory. I have
used both Windows Explorer and Cygwin "ls -l" and "getacl" commands to
verify that the permissions are identical. When I try to start the
PostgreSQL 8.4 service, it takes a long time and then reports that it
did not start. The Event Viewer has an error message "EDTFATAL: could
not load root certificate file "root.crt": Input/output error"

Any ideas?
Thanks.

-Mike

Browse pgsql-novice by date

  From Date Subject
Next Message Michael Swierczek 2009-07-23 20:15:44 Re: Setting up security for development
Previous Message Thurber, Fred 2009-07-23 17:14:54 Understanding the output of EXPLAIN ANALYSE