SSL client crt verification

From: "Knut P Lehre" <k(dot)p(dot)lehre(at)world-online(dot)no>
To: pgsql-hackers(at)postgresql(dot)org
Subject: SSL client crt verification
Date: 2005-08-26 13:23:18
Message-ID: 42BFF0E800000CD1@cpfe4.be.tisc.dk
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-hackers

Tried doc search, pgsql-general and #postgresql.

Server: 7.4.8 on Red Hat EL4. Client psql 8.0.3 on WinXP.
Using a test server.crt and server.key, as described in 8.0 docs 16.8, I
can activate SSL encryption (WinXP 8.0.3 psql reports "SSL Connection" at
connect), and as expected, the server log reports that root.crt is not found.
If I copy server.crt to root.crt and start up server again, the missing
root.crt message disappears. But I can still connect with psql with no postgresql.crt
on client (docs 27.13). Apparently, the root.crt, which in this case is
a copy of server.crt, is not interpreted as a CA crt, but how does the server
know? Isn't a CA cert just a self signed crt? Why is there not a warning
that client authentication will not take place, when it apparently does
not? Does the server only check that a root.crt file is present, and not
that is contains valid information?

Comments appreciated
KPL

Responses

Browse pgsql-hackers by date

  From Date Subject
Next Message Hiroshi Saito 2005-08-26 14:06:49 Re: [ANNOUNCE] Welcome Core Team member Dave Page
Previous Message Michael Meskes 2005-08-26 13:09:11 Re: [HACKERS] ECPG ignores SAVEPOINT if first statement of a transaction