database/postgres
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2025-06-20 15:22:23 +03:00
Code Activity

Add parameters for controlling locations of server-side SSL files

Browse Source 
This allows changing the location of the files that were previously
hard-coded to server.crt, server.key, root.crt, root.crl.

server.crt and server.key continue to be the default settings and are
thus required to be present by default if SSL is enabled.  But the
settings for the server-side CA and CRL are now empty by default, and
if they are set, the files are required to be present.  This replaces
the previous behavior of ignoring the functionality if the files were
not found.
This commit is contained in:
Peter Eisentraut
2012-02-22 23:40:46 +02:00
parent a417f85e1d
commit a445cb92ef
7 changed files with 180 additions and 81 deletions
Download Patch File Download Diff File Expand all files Collapse all files

64
doc/src/sgml/config.sgml
View File

@ -668,6 +668,70 @@ SET ENABLE_SEQSCAN TO OFF;
</listitem>
</varlistentry>
<varlistentry id="guc-ssl-ca-file" xreflabel="ssl_ca_file">
<term><varname>ssl_ca_file</varname> (<type>string</type>)</term>
<indexterm>
<primary><varname>ssl_ca_file</> configuration parameter</primary>
</indexterm>
<listitem>
<para>
Specifies the name of the file containing the SSL server certificate
authority (CA). The default is empty, meaning no CA file is loaded,
and client certificate verification is not performed. (In previous
releases of PostgreSQL, the name of this file was hard-coded
as <filename>root.crt</filename>.) Relative paths are relative to the
data directory. This parameter can only be set at server start.
</para>
</listitem>
</varlistentry>
<varlistentry id="guc-ssl-cert-file" xreflabel="ssl_cert_file">
<term><varname>ssl_cert_file</varname> (<type>string</type>)</term>
<indexterm>
<primary><varname>ssl_cert_file</> configuration parameter</primary>
</indexterm>
<listitem>
<para>
Specifies the name of the file containing the SSL server certificate.
The default is <filename>server.crt</filename>. Relative paths are
relative to the data directory. This parameter can only be set at
server start.
</para>
</listitem>
</varlistentry>
<varlistentry id="guc-ssl-crl-file" xreflabel="ssl_crl_file">
<term><varname>ssl_crl_file</varname> (<type>string</type>)</term>
<indexterm>
<primary><varname>ssl_crl_file</> configuration parameter</primary>
</indexterm>
<listitem>
<para>
Specifies the name of the file containing the SSL server certificate
revocation list (CRL). The default is empty, meaning no CRL file is
loaded. (In previous releases of PostgreSQL, the name of this file was
hard-coded as <filename>root.crl</filename>.) Relative paths are
relative to the data directory. This parameter can only be set at
server start.
</para>
</listitem>
</varlistentry>
<varlistentry id="guc-ssl-key-file" xreflabel="ssl_key_file">
<term><varname>ssl_key_file</varname> (<type>string</type>)</term>
<indexterm>
<primary><varname>ssl_key_file</> configuration parameter</primary>
</indexterm>
<listitem>
<para>
Specifies the name of the file containing the SSL server private key.
The default is <filename>server.key</filename>. Relative paths are
relative to the data directory. This parameter can only be set at
server start.
</para>
</listitem>
</varlistentry>
<varlistentry id="guc-ssl-renegotiation-limit" xreflabel="ssl_renegotiation_limit">
<term><varname>ssl_renegotiation_limit</varname> (<type>integer</type>)</term>
<indexterm>

36
doc/src/sgml/runtime.sgml
View File

@ -1831,10 +1831,8 @@ pg_dumpall -p 5432 | psql -d postgres -p 5433
SSL certificates and make sure that clients check the server's certificate.
To do that, the server
must be configured to accept only <literal>hostssl</> connections (<xref
linkend="auth-pg-hba-conf">) and have SSL
<filename>server.key</filename> (key) and
<filename>server.crt</filename> (certificate) files (<xref
linkend="ssl-tcp">). The TCP client must connect using
linkend="auth-pg-hba-conf">) and have SSL key and certificate files
(<xref linkend="ssl-tcp">). The TCP client must connect using
<literal>sslmode=verify-ca</> or
<literal>verify-full</> and have the appropriate root certificate
file installed (<xref linkend="libpq-connect">).
@ -2053,10 +2051,12 @@ pg_dumpall -p 5432 | psql -d postgres -p 5433
</note>
<para>
To start in <acronym>SSL</> mode, the files <filename>server.crt</>
and <filename>server.key</> must exist in the server's data directory.
These files should contain the server certificate and private key,
respectively.
To start in <acronym>SSL</> mode, files containing the server certificate
and private key must exist. By default, these files are expected to be
named <filename>server.crt</> and <filename>server.key</>, respectively, in
the server's data directory, but other names and locations can be specified
using the configuration parameters <xref linkend="guc-ssl-cert-file">
and <xref linkend="guc-ssl-key-file">.
On Unix systems, the permissions on <filename>server.key</filename> must
disallow any access to world or group; achieve this by the command
<command>chmod 0600 server.key</command>.
@ -2083,7 +2083,9 @@ pg_dumpall -p 5432 | psql -d postgres -p 5433
To require the client to supply a trusted certificate, place
certificates of the certificate authorities (<acronym>CA</acronym>s)
you trust in the file <filename>root.crt</filename> in the data
directory, and set the <literal>clientcert</literal> parameter
directory, set the parameter <xref linkend="guc-ssl-ca-file"> in
<filename>postgresql.conf</filename> to <literal>root.crt</literal>,
and set the <literal>clientcert</literal> parameter
to 1 on the appropriate <literal>hostssl</> line(s) in
<filename>pg_hba.conf</>.
A certificate will then be requested from the client during
@ -2091,7 +2093,7 @@ pg_dumpall -p 5432 | psql -d postgres -p 5433
description of how to set up certificates on the client.) The server will
verify that the client's certificate is signed by one of the trusted
certificate authorities. Certificate Revocation List (CRL) entries
are also checked if the file <filename>root.crl</filename> exists.
are also checked if the parameter <xref linkend="guc-ssl-crl-file"> is set.
<!-- If this URL changes replace it with a URL to www.archive.org. -->
(See <ulink
url="http://h71000.www7.hp.com/DOC/83final/BA554_90007/ch04s02.html"></>
@ -2103,7 +2105,7 @@ pg_dumpall -p 5432 | psql -d postgres -p 5433
available for all authentication methods, but only for rows specified as
<literal>hostssl</>. When <literal>clientcert</literal> is not specified
or is set to 0, the server will still verify presented client
certificates against <filename>root.crt</filename> if that file exists
certificates against its CA list, if one is configured,
&mdash; but it will not insist that a client certificate be presented.
</para>
@ -2127,7 +2129,8 @@ pg_dumpall -p 5432 | psql -d postgres -p 5433
<para>
<xref linkend="ssl-file-usage"> summarizes the files that are
relevant to the SSL setup on the server.
relevant to the SSL setup on the server. (The shown file names are default
or typical names. The locally configured names could be different.)
</para>
<table id="ssl-file-usage">
@ -2144,27 +2147,27 @@ pg_dumpall -p 5432 | psql -d postgres -p 5433
<tbody>
<row>
<entry><filename>$PGDATA/server.crt</></entry>
<entry><xref linkend="guc-ssl-cert-file"> (<filename>$PGDATA/server.crt</>)</entry>
<entry>server certificate</entry>
<entry>sent to client to indicate server's identity</entry>
</row>
<row>
<entry><filename>$PGDATA/server.key</></entry>
<entry><xref linkend="guc-ssl-key-file"> (<filename>$PGDATA/server.key</>)</entry>
<entry>server private key</entry>
<entry>proves server certificate was sent by the owner; does not indicate
certificate owner is trustworthy</entry>
</row>
<row>
<entry><filename>$PGDATA/root.crt</></entry>
<entry><xref linkend="guc-ssl-ca-file"> (<filename>$PGDATA/root.crt</>)</entry>
<entry>trusted certificate authorities</entry>
<entry>checks that client certificate is
signed by a trusted certificate authority</entry>
</row>
<row>
<entry><filename>$PGDATA/root.crl</></entry>
<entry><xref linkend="guc-ssl-crl-file"> (<filename>$PGDATA/root.crl</>)</entry>
<entry>certificates revoked by certificate authorities</entry>
<entry>client certificate must not be on this list</entry>
</row>
@ -2176,6 +2179,7 @@ pg_dumpall -p 5432 | psql -d postgres -p 5433
<para>
The files <filename>server.key</>, <filename>server.crt</>,
<filename>root.crt</filename>, and <filename>root.crl</filename>
(or their configured alternative names)
are only examined during server start; so you must restart
the server for changes in them to take effect.
</para>