Re: Trust intermediate CA for client certificates

On Mon, Dec 2, 2013 at 03:07:48PM -0500, Tom Lane wrote:
> Bruce Momjian <bruce(at)momjian(dot)us> writes:
> > On Mon, Dec 2, 2013 at 12:59:41PM -0500, Tom Lane wrote:
> >> I see that you removed the sentence
> >> The root
> >> certificate should be included in every case where
> >> <filename>postgresql.crt</> contains more than one certificate.
>
> > I don't fully understand the issues but the discussion seens to indicate
> > this. Am I missing something? Should I run some tests?
>
> My recollection is that if the client cert file includes *only* the
> client's own cert, the server will puzzle out how that connects to the
> certs it has. However, if the client cert file contains more than one
> cert (ie, client's cert and some intermediate-CA cert), the server
> will *not* try to associate the intermediate cert with some root cert it
> has. It wants the chain the client sends to terminate in a cert that it
> has listed directly in root.crt.

OK, so you are saying if the client only supplies one cert, it will try
to find a signing cert in root.crt, but if multiple certs are supplied,
you have to get a cert match (not a signing). I can adjust the docs for
that.

--
Bruce Momjian <bruce(at)momjian(dot)us> http://momjian.us
EnterpriseDB http://enterprisedb.com

+ Everyone has their own god. +