pgsql/src backend/libpq/be-secure.c include/li ...
CVSROOT: /cvsroot
Module name: pgsql
Changes by: momjian@postgresql.org 02/06/14 00:36:58
Modified files:
src/backend/libpq: be-secure.c
src/include/libpq: libpq-be.h
src/interfaces/libpq: fe-secure.c
Log message:
SSL patch that adds support for optional client certificates.
If the user has certificates in $HOME/.postgresql/postgresql.crt
and $HOME/.postgresql/postgresql.key exist, they are provided
to the server. The certificate used to sign this cert must be
known to the server, in $DataDir/root.crt. If successful, the
cert's "common name" is logged.
Client certs are not used for authentication, but they could be
via the port->peer (X509 *), port->peer_dn (char *) or
port->peer_cn (char *) fields. Or any other function could be
used, e.g., many sites like the issuer + serial number hash.
Bear Giles
If the user has certificates in $HOME/.postgresql/postgresql.crt
and $HOME/.postgresql/postgresql.key exist, they are provided
to the server. The certificate used to sign this cert must be
known to the server, in $DataDir/root.crt. If successful, the
cert's "common name" is logged.
How about we put a script or Makefile in $datadir that eases the generation
of a server cert and signing users...?
Chris
Doh - looks like there's one in the ssl interfaces section...
Chris
Show quoted text
-----Original Message-----
From: pgsql-committers-owner@postgresql.org
[mailto:pgsql-committers-owner@postgresql.org]On Behalf Of Christopher
Kings-Lynne
Sent: Friday, 14 June 2002 12:51 PM
To: Bruce Momjian - CVS; pgsql-committers@postgresql.org
Subject: Re: [COMMITTERS] pgsql/src backend/libpq/be-secure.c include/li
...If the user has certificates in $HOME/.postgresql/postgresql.crt
and $HOME/.postgresql/postgresql.key exist, they are provided
to the server. The certificate used to sign this cert must be
known to the server, in $DataDir/root.crt. If successful, the
cert's "common name" is logged.How about we put a script or Makefile in $datadir that eases the
generation
of a server cert and signing users...?Chris
---------------------------(end of broadcast)---------------------------
TIP 3: if posting/reading through Usenet, please send an appropriate
subscribe-nomail command to majordomo@postgresql.org so that your
message can get through to the mailing list cleanly
Christopher Kings-Lynne wrote:
Doh - looks like there's one in the ssl interfaces section...
Yes, I put the tools stuff in interfaces/ssl. Not sure what to do with
it, though. No makfile supplied or anything.
Chris
-----Original Message-----
From: pgsql-committers-owner@postgresql.org
[mailto:pgsql-committers-owner@postgresql.org]On Behalf Of Christopher
Kings-Lynne
Sent: Friday, 14 June 2002 12:51 PM
To: Bruce Momjian - CVS; pgsql-committers@postgresql.org
Subject: Re: [COMMITTERS] pgsql/src backend/libpq/be-secure.c include/li
...If the user has certificates in $HOME/.postgresql/postgresql.crt
and $HOME/.postgresql/postgresql.key exist, they are provided
to the server. The certificate used to sign this cert must be
known to the server, in $DataDir/root.crt. If successful, the
cert's "common name" is logged.How about we put a script or Makefile in $datadir that eases the
generation
of a server cert and signing users...?Chris
---------------------------(end of broadcast)---------------------------
TIP 3: if posting/reading through Usenet, please send an appropriate
subscribe-nomail command to majordomo@postgresql.org so that your
message can get through to the mailing list cleanly---------------------------(end of broadcast)---------------------------
TIP 3: if posting/reading through Usenet, please send an appropriate
subscribe-nomail command to majordomo@postgresql.org so that your
message can get through to the mailing list cleanly
--
Bruce Momjian | http://candle.pha.pa.us
pgman@candle.pha.pa.us | (610) 853-3000
+ If your life is a hard drive, | 830 Blythe Avenue
+ Christ can be your backup. | Drexel Hill, Pennsylvania 19026