Participants
Bruce Momjian
Bruce Momjian
Bear Giles
Bear Giles
Attachments
Show all attachments
Thread Outline
#1Bear GilesBear Giles
May 25, 2002
#2Bruce Momjian↳Bruce Momjianto Bear Giles (#1)
Jun 11, 2002
#3Bruce Momjian↳Bruce Momjianto Bear Giles (#1)
Jun 14, 2002

SSL (patch 9)

Started by Bear Gilesabout 24 years ago3 messagespatches
Jump to latest
#1Bear Giles
Bear Giles
bgiles@coyotesong.com

SSL patch that adds support for optional client certificates.

If the user has certificates in $HOME/.postgresql/postgresql.crt
and $HOME/.postgresql/postgresql.key exist, they are provided
to the server. The certificate used to sign this cert must be
known to the server, in $DataDir/root.crt. If successful, the
cert's "common name" is logged.

Client certs are not used for authentication, but they could be
via the port->peer (X509 *), port->peer_dn (char *) or
port->peer_cn (char *) fields. Or any other function could be
used, e.g., many sites like the issuer + serial number hash.

Bear

Attachments:

patch9text/plain; charset=US-ASCIIDownload+177-12
#2Bruce Momjian
Bruce Momjian
bruce@momjian.us
In reply to: Bear Giles (#1)
Re: SSL (patch 9)

Your patch has been added to the PostgreSQL unapplied patches list at:

http://candle.pha.pa.us/cgi-bin/pgpatches

I will try to apply it within the next 48 hours.

---------------------------------------------------------------------------

Bear Giles wrote:

SSL patch that adds support for optional client certificates.

If the user has certificates in $HOME/.postgresql/postgresql.crt
and $HOME/.postgresql/postgresql.key exist, they are provided
to the server. The certificate used to sign this cert must be
known to the server, in $DataDir/root.crt. If successful, the
cert's "common name" is logged.

Client certs are not used for authentication, but they could be
via the port->peer (X509 *), port->peer_dn (char *) or
port->peer_cn (char *) fields. Or any other function could be
used, e.g., many sites like the issuer + serial number hash.

Bear

Content-Description: /tmp/patch9

[ Attachment, skipping... ]

---------------------------(end of broadcast)---------------------------
TIP 4: Don't 'kill -9' the postmaster

-- 
  Bruce Momjian                        |  http://candle.pha.pa.us
  pgman@candle.pha.pa.us               |  (610) 853-3000
  +  If your life is a hard drive,     |  830 Blythe Avenue
  +  Christ can be your backup.        |  Drexel Hill, Pennsylvania 19026
#3Bruce Momjian
Bruce Momjian
bruce@momjian.us
In reply to: Bear Giles (#1)
Re: SSL (patch 9)

Patch applied. Thanks.

---------------------------------------------------------------------------

Bear Giles wrote:

SSL patch that adds support for optional client certificates.

If the user has certificates in $HOME/.postgresql/postgresql.crt
and $HOME/.postgresql/postgresql.key exist, they are provided
to the server. The certificate used to sign this cert must be
known to the server, in $DataDir/root.crt. If successful, the
cert's "common name" is logged.

Client certs are not used for authentication, but they could be
via the port->peer (X509 *), port->peer_dn (char *) or
port->peer_cn (char *) fields. Or any other function could be
used, e.g., many sites like the issuer + serial number hash.

Bear

Content-Description: /tmp/patch9

[ Attachment, skipping... ]

---------------------------(end of broadcast)---------------------------
TIP 4: Don't 'kill -9' the postmaster

-- 
  Bruce Momjian                        |  http://candle.pha.pa.us
  pgman@candle.pha.pa.us               |  (610) 853-3000
  +  If your life is a hard drive,     |  830 Blythe Avenue
  +  Christ can be your backup.        |  Drexel Hill, Pennsylvania 19026
← Back to Topics