From a445cb92ef5b3a31313ebce30e18cc1d6e0bdecb Mon Sep 17 00:00:00 2001 From: Peter Eisentraut Date: Wed, 22 Feb 2012 23:40:46 +0200 Subject: Add parameters for controlling locations of server-side SSL files This allows changing the location of the files that were previously hard-coded to server.crt, server.key, root.crt, root.crl. server.crt and server.key continue to be the default settings and are thus required to be present by default if SSL is enabled. But the settings for the server-side CA and CRL are now empty by default, and if they are set, the files are required to be present. This replaces the previous behavior of ignoring the functionality if the files were not found. --- doc/src/sgml/config.sgml | 64 +++++++++++++++++++++++++++++++++++++++++++++++ doc/src/sgml/runtime.sgml | 36 ++++++++++++++------------ 2 files changed, 84 insertions(+), 16 deletions(-) (limited to 'doc/src') diff --git a/doc/src/sgml/config.sgml b/doc/src/sgml/config.sgml index 0ea9aebdb02..6e1378a9d6d 100644 --- a/doc/src/sgml/config.sgml +++ b/doc/src/sgml/config.sgml @@ -668,6 +668,70 @@ SET ENABLE_SEQSCAN TO OFF; + + ssl_ca_file (string) + + ssl_ca_file configuration parameter + + + + Specifies the name of the file containing the SSL server certificate + authority (CA). The default is empty, meaning no CA file is loaded, + and client certificate verification is not performed. (In previous + releases of PostgreSQL, the name of this file was hard-coded + as root.crt.) Relative paths are relative to the + data directory. This parameter can only be set at server start. + + + + + + ssl_cert_file (string) + + ssl_cert_file configuration parameter + + + + Specifies the name of the file containing the SSL server certificate. + The default is server.crt. Relative paths are + relative to the data directory. This parameter can only be set at + server start. + + + + + + ssl_crl_file (string) + + ssl_crl_file configuration parameter + + + + Specifies the name of the file containing the SSL server certificate + revocation list (CRL). The default is empty, meaning no CRL file is + loaded. (In previous releases of PostgreSQL, the name of this file was + hard-coded as root.crl.) Relative paths are + relative to the data directory. This parameter can only be set at + server start. + + + + + + ssl_key_file (string) + + ssl_key_file configuration parameter + + + + Specifies the name of the file containing the SSL server private key. + The default is server.key. Relative paths are + relative to the data directory. This parameter can only be set at + server start. + + + + ssl_renegotiation_limit (integer) diff --git a/doc/src/sgml/runtime.sgml b/doc/src/sgml/runtime.sgml index 1c3a9c87d8a..5785450e571 100644 --- a/doc/src/sgml/runtime.sgml +++ b/doc/src/sgml/runtime.sgml @@ -1831,10 +1831,8 @@ pg_dumpall -p 5432 | psql -d postgres -p 5433 SSL certificates and make sure that clients check the server's certificate. To do that, the server must be configured to accept only hostssl connections () and have SSL - server.key (key) and - server.crt (certificate) files (). The TCP client must connect using + linkend="auth-pg-hba-conf">) and have SSL key and certificate files + (). The TCP client must connect using sslmode=verify-ca or verify-full and have the appropriate root certificate file installed (). @@ -2053,10 +2051,12 @@ pg_dumpall -p 5432 | psql -d postgres -p 5433 - To start in SSL mode, the files server.crt - and server.key must exist in the server's data directory. - These files should contain the server certificate and private key, - respectively. + To start in SSL mode, files containing the server certificate + and private key must exist. By default, these files are expected to be + named server.crt and server.key, respectively, in + the server's data directory, but other names and locations can be specified + using the configuration parameters + and . On Unix systems, the permissions on server.key must disallow any access to world or group; achieve this by the command chmod 0600 server.key. @@ -2083,7 +2083,9 @@ pg_dumpall -p 5432 | psql -d postgres -p 5433 To require the client to supply a trusted certificate, place certificates of the certificate authorities (CAs) you trust in the file root.crt in the data - directory, and set the clientcert parameter + directory, set the parameter in + postgresql.conf to root.crt, + and set the clientcert parameter to 1 on the appropriate hostssl line(s) in pg_hba.conf. A certificate will then be requested from the client during @@ -2091,7 +2093,7 @@ pg_dumpall -p 5432 | psql -d postgres -p 5433 description of how to set up certificates on the client.) The server will verify that the client's certificate is signed by one of the trusted certificate authorities. Certificate Revocation List (CRL) entries - are also checked if the file root.crl exists. + are also checked if the parameter is set. (See @@ -2103,7 +2105,7 @@ pg_dumpall -p 5432 | psql -d postgres -p 5433 available for all authentication methods, but only for rows specified as hostssl. When clientcert is not specified or is set to 0, the server will still verify presented client - certificates against root.crt if that file exists + certificates against its CA list, if one is configured, — but it will not insist that a client certificate be presented. @@ -2127,7 +2129,8 @@ pg_dumpall -p 5432 | psql -d postgres -p 5433 summarizes the files that are - relevant to the SSL setup on the server. + relevant to the SSL setup on the server. (The shown file names are default + or typical names. The locally configured names could be different.) @@ -2144,27 +2147,27 @@ pg_dumpall -p 5432 | psql -d postgres -p 5433 - $PGDATA/server.crt + ($PGDATA/server.crt) server certificate sent to client to indicate server's identity - $PGDATA/server.key + ($PGDATA/server.key) server private key proves server certificate was sent by the owner; does not indicate certificate owner is trustworthy - $PGDATA/root.crt + ($PGDATA/root.crt) trusted certificate authorities checks that client certificate is signed by a trusted certificate authority - $PGDATA/root.crl + ($PGDATA/root.crl) certificates revoked by certificate authorities client certificate must not be on this list @@ -2176,6 +2179,7 @@ pg_dumpall -p 5432 | psql -d postgres -p 5433 The files server.key, server.crt, root.crt, and root.crl + (or their configured alternative names) are only examined during server start; so you must restart the server for changes in them to take effect. -- cgit v1.2.3