Re: Trust intermediate CA for client certificates

From: Bruce Momjian <bruce(at)momjian(dot)us>
To: Craig Ringer <craig(at)2ndquadrant(dot)com>
Cc: Stephen Frost <sfrost(at)snowman(dot)net>, Ian Pilcher <arequipeno(at)gmail(dot)com>, Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us>, stellr(at)vt(dot)edu, PostgreSQL Hackers <pgsql-hackers(at)postgresql(dot)org>
Subject: Re: Trust intermediate CA for client certificates
Date: 2013-12-02 17:44:08
Message-ID: 20131202174408.GE5274@momjian.us
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-general pgsql-hackers

On Sat, Nov 30, 2013 at 12:10:19PM -0500, Bruce Momjian wrote:
> > Drat, you're quite right. I've always included the full certificate
> > chain in client certs but it's in no way required.
> >
> > I guess that pretty much means maintaining the status quo and documenting
> > it better.
>
> I have developed the attached patch to document this behavior. My goals
> were:
>
> * clarify that a cert can match a remote intermediate or root certificate
> * clarify that the client cert must match a server root.crt
> * clarify that the server cert much match a client root.crt
> * clarify that the root certificate does not have to be specified
> in the client or server cert as long as the remote end has the chain
> to the root
>
> Does it meet these goals? Is it correct?

I have updated the patch, attached, to be clearer about the requirement
that intermediate certificates need a chain to root certificates.

--
Bruce Momjian <bruce(at)momjian(dot)us> http://momjian.us
EnterpriseDB http://enterprisedb.com

+ Everyone has their own god. +

Attachment Content-Type Size
cert.diff text/x-diff 6.0 KB

In response to

Responses

Browse pgsql-general by date

  From Date Subject
Next Message Karsten Hilbert 2013-12-02 17:57:53 Re: [GENERAL] pg_upgrade ?deficiency
Previous Message Zev Benjamin 2013-12-02 16:44:52 Re: unnest on multi-dimensional arrays

Browse pgsql-hackers by date

  From Date Subject
Next Message Bruce Momjian 2013-12-02 17:51:47 Re: Re: Suggestion: Issue warning when calling SET TRANSACTION outside transaction block
Previous Message Jeff Janes 2013-12-02 17:41:07 Re: Handling GIN incomplete splits