Re: no verification of client certificate?

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Sun, Mar 25, 2007 at 10:01:20PM -0400, Tom Lane wrote:
> I looked more closely and you are right: if the server does not have
> a root.crt file then it doesn't send its server cert to the client,
> and so there's no way for the client to verify the cert.

Eh?  ssldump shows otherwise here with 8.2.3.  Here's a connection
where the server has server.key and server.crt but no root.crt, and
the client has the root.crt that signed server.crt and nothing else
in ~/.postgresql:

1 1  0.0338 (0.0338)  C>S  Handshake      ClientHello
1 2  0.5179 (0.4841)  S>C  Handshake      ServerHello
1 3  0.5179 (0.0000)  S>C  Handshake      Certificate
1 4  0.5181 (0.0001)  S>C  Handshake      ServerKeyExchange
1 5  0.5181 (0.0000)  S>C  Handshake      ServerHelloDone
1 6  0.6115 (0.0934)  C>S  Handshake      ClientKeyExchange
1 7  0.6115 (0.0000)  C>S  ChangeCipherSpec
1 8  0.6115 (0.0000)  C>S  Handshake
1 9  0.9605 (0.3489)  S>C  ChangeCipherSpec
1 10 0.9605 (0.0000)  S>C  Handshake

The client is now connected with DHE-RSA-AES256-SHA.

Here's a dump with the same server configuration (server.key, server.crt,
no root.crt) but now the client has a different root.crt than the one
that signed server.crt:

1 1  0.0335 (0.0335)  C>S  Handshake      ClientHello
1 2  0.5626 (0.5290)  S>C  Handshake      ServerHello
1 3  0.5626 (0.0000)  S>C  Handshake      Certificate
1 4  0.5628 (0.0001)  S>C  Handshake      ServerKeyExchange
1 5  0.5628 (0.0000)  S>C  Handshake      ServerHelloDone
1 6  0.5644 (0.0016)  C>S  Alert          fatal          unknown_ca

If the client has PGSSLMODE set to "require" then the connection
fails at the client with "psql: SSL error: certificate verify failed"
and the server logs "could not accept SSL connection: tlsv1 alert
unknown ca".

Did you run any tests?  If so, how did you generate the server's
certificate?

-- 
Michael Fuhr


[Index of Archives]     [KVM ARM]     [KVM ia64]     [KVM ppc]     [Virtualization Tools]     [Spice Development]     [Libvirt]     [Libvirt Users]     [Linux USB Devel]     [Linux Audio Users]     [Yosemite Questions]     [Linux Kernel]     [Linux SCSI]     [XFree86]

  Powered by Linux