mirror of
https://github.com/postgres/postgres.git
synced 2025-09-02 04:21:28 +03:00
doc: Remove mentions of server-side CRL and CA file names
Commit a445cb92ef
removed the default file
names for server-side CRL and CA files, but left them in the docs with a
small note. This removes the note and the previous default names to
clarify, as well as changes mentions of the file names to make it
clearer that they are configurable.
Author: Daniel Gustafsson <daniel@yesql.se>
Reviewed-by: Michael Paquier <michael.paquier@gmail.com>
This commit is contained in:
@@ -983,10 +983,6 @@ include_dir 'conf.d'
|
|||||||
The default is empty, meaning no CA file is loaded,
|
The default is empty, meaning no CA file is loaded,
|
||||||
and client certificate verification is not performed.
|
and client certificate verification is not performed.
|
||||||
</para>
|
</para>
|
||||||
<para>
|
|
||||||
In previous releases of PostgreSQL, the name of this file was
|
|
||||||
hard-coded as <filename>root.crt</filename>.
|
|
||||||
</para>
|
|
||||||
</listitem>
|
</listitem>
|
||||||
</varlistentry>
|
</varlistentry>
|
||||||
|
|
||||||
@@ -1022,10 +1018,6 @@ include_dir 'conf.d'
|
|||||||
file or on the server command line.
|
file or on the server command line.
|
||||||
The default is empty, meaning no CRL file is loaded.
|
The default is empty, meaning no CRL file is loaded.
|
||||||
</para>
|
</para>
|
||||||
<para>
|
|
||||||
In previous releases of PostgreSQL, the name of this file was
|
|
||||||
hard-coded as <filename>root.crl</filename>.
|
|
||||||
</para>
|
|
||||||
</listitem>
|
</listitem>
|
||||||
</varlistentry>
|
</varlistentry>
|
||||||
|
|
||||||
|
@@ -7638,8 +7638,8 @@ ldap://ldap.acme.com/cn=dbserver,cn=hosts?pgconnectinfo?base?(objectclass=*)
|
|||||||
certificate of the signing authority to the <filename>postgresql.crt</>
|
certificate of the signing authority to the <filename>postgresql.crt</>
|
||||||
file, then its parent authority's certificate, and so on up to a certificate
|
file, then its parent authority's certificate, and so on up to a certificate
|
||||||
authority, <quote>root</> or <quote>intermediate</>, that is trusted by
|
authority, <quote>root</> or <quote>intermediate</>, that is trusted by
|
||||||
the server, i.e. signed by a certificate in the server's
|
the server, i.e. signed by a certificate in the server's root CA file
|
||||||
<filename>root.crt</filename> file.
|
(<xref linkend="guc-ssl-ca-file">).
|
||||||
</para>
|
</para>
|
||||||
|
|
||||||
<para>
|
<para>
|
||||||
|
@@ -2264,7 +2264,7 @@ pg_dumpall -p 5432 | psql -d postgres -p 5433
|
|||||||
<para>
|
<para>
|
||||||
To require the client to supply a trusted certificate, place
|
To require the client to supply a trusted certificate, place
|
||||||
certificates of the certificate authorities (<acronym>CA</acronym>s)
|
certificates of the certificate authorities (<acronym>CA</acronym>s)
|
||||||
you trust in the file <filename>root.crt</filename> in the data
|
you trust in a file named <filename>root.crt</filename> in the data
|
||||||
directory, set the parameter <xref linkend="guc-ssl-ca-file"> in
|
directory, set the parameter <xref linkend="guc-ssl-ca-file"> in
|
||||||
<filename>postgresql.conf</filename> to <literal>root.crt</literal>,
|
<filename>postgresql.conf</filename> to <literal>root.crt</literal>,
|
||||||
and add the authentication option <literal>clientcert=1</literal> to the
|
and add the authentication option <literal>clientcert=1</literal> to the
|
||||||
@@ -2321,7 +2321,7 @@ pg_dumpall -p 5432 | psql -d postgres -p 5433
|
|||||||
<para>
|
<para>
|
||||||
<xref linkend="ssl-file-usage"> summarizes the files that are
|
<xref linkend="ssl-file-usage"> summarizes the files that are
|
||||||
relevant to the SSL setup on the server. (The shown file names are default
|
relevant to the SSL setup on the server. (The shown file names are default
|
||||||
or typical names. The locally configured names could be different.)
|
names. The locally configured names could be different.)
|
||||||
</para>
|
</para>
|
||||||
|
|
||||||
<table id="ssl-file-usage">
|
<table id="ssl-file-usage">
|
||||||
@@ -2351,14 +2351,14 @@ pg_dumpall -p 5432 | psql -d postgres -p 5433
|
|||||||
</row>
|
</row>
|
||||||
|
|
||||||
<row>
|
<row>
|
||||||
<entry><xref linkend="guc-ssl-ca-file"> (<filename>$PGDATA/root.crt</>)</entry>
|
<entry><xref linkend="guc-ssl-ca-file"></entry>
|
||||||
<entry>trusted certificate authorities</entry>
|
<entry>trusted certificate authorities</entry>
|
||||||
<entry>checks that client certificate is
|
<entry>checks that client certificate is
|
||||||
signed by a trusted certificate authority</entry>
|
signed by a trusted certificate authority</entry>
|
||||||
</row>
|
</row>
|
||||||
|
|
||||||
<row>
|
<row>
|
||||||
<entry><xref linkend="guc-ssl-crl-file"> (<filename>$PGDATA/root.crl</>)</entry>
|
<entry><xref linkend="guc-ssl-crl-file"></entry>
|
||||||
<entry>certificates revoked by certificate authorities</entry>
|
<entry>certificates revoked by certificate authorities</entry>
|
||||||
<entry>client certificate must not be on this list</entry>
|
<entry>client certificate must not be on this list</entry>
|
||||||
</row>
|
</row>
|
||||||
|
@@ -150,7 +150,7 @@
|
|||||||
</para>
|
</para>
|
||||||
<para>
|
<para>
|
||||||
This function is really useful only if you have more than one trusted CA
|
This function is really useful only if you have more than one trusted CA
|
||||||
certificate in your server's <filename>root.crt</> file, or if this CA
|
certificate in your server's certificate authority file, or if this CA
|
||||||
has issued some intermediate certificate authority certificates.
|
has issued some intermediate certificate authority certificates.
|
||||||
</para>
|
</para>
|
||||||
</listitem>
|
</listitem>
|
||||||
|
Reference in New Issue
Block a user