Creating Certificates

From: Tatsuo Ishii <ishii(at)sraoss(dot)co(dot)jp>
To: pgsql-docs(at)postgresql(dot)org
Subject: Creating Certificates
Date: 2018-10-05 23:17:04
Message-ID: 20181006.081704.1372328430253415862.t-ishii@sraoss.co.jp
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-docs pgsql-hackers

In "18.9.3. Creating Certificates",

------------------------------------------------------------------
To create a server certificate whose identity can be validated by
clients, first create a certificate signing request (CSR) and a
public/private key file:

openssl req -new -nodes -text -out root.csr \
-keyout root.key -subj "/CN=root.yourdomain.com"
chmod og-rwx root.key

Then, sign the request with the key to create a root certificate
authority (using the default OpenSSL configuration file location on
Linux):

openssl x509 -req -in root.csr -text -days 3650 \
-extfile /etc/ssl/openssl.cnf -extensions v3_ca \
-signkey root.key -out root.crt
------------------------------------------------------------------

For me it seesm the two-step procedure can be replaced with following
one command:

openssl req -new -x509 -nodes -text -days 3650 \
-config /etc/ssl/openssl.cnf -extensions v3_ca \
-out root.crt -keyout root.key -subj "/CN=root.yourdomain.com"

Is there any reaon why our doc recommend the two-step procedure?

Best regards,
--
Tatsuo Ishii
SRA OSS, Inc. Japan
English: http://www.sraoss.co.jp/index_en.php
Japanese:http://www.sraoss.co.jp

Responses

Browse pgsql-docs by date

  From Date Subject
Next Message Tatsuo Ishii 2018-10-06 09:46:54 Re: Creating Certificates
Previous Message Jonathan S. Katz 2018-10-04 22:33:07 Re: Proposed HTML Documentation Styles

Browse pgsql-hackers by date

  From Date Subject
Next Message Michael Paquier 2018-10-05 23:54:54 Re: Segfault when creating partition with a primary key and sql_drop trigger exists
Previous Message David Fetter 2018-10-05 22:43:11 Re: Early WIP/PoC for inlining CTEs