From: | Jacob Champion <pchampion(at)vmware(dot)com> |
---|---|
To: | "daniel(at)yesql(dot)se" <daniel(at)yesql(dot)se> |
Cc: | "hlinnaka(at)iki(dot)fi" <hlinnaka(at)iki(dot)fi>, "pgsql-hackers(at)lists(dot)postgresql(dot)org" <pgsql-hackers(at)lists(dot)postgresql(dot)org>, "andrew(dot)dunstan(at)2ndquadrant(dot)com" <andrew(dot)dunstan(at)2ndquadrant(dot)com>, "sfrost(at)snowman(dot)net" <sfrost(at)snowman(dot)net>, "thomas(dot)munro(at)gmail(dot)com" <thomas(dot)munro(at)gmail(dot)com>, "michael(at)paquier(dot)xyz" <michael(at)paquier(dot)xyz>, "andres(at)anarazel(dot)de" <andres(at)anarazel(dot)de> |
Subject: | Re: Support for NSS as a libpq TLS backend |
Date: | 2021-01-20 17:07:08 |
Message-ID: | a9b663ae4a4b71525e88b75463c865a6693cb4ce.camel@vmware.com |
Views: | Raw Message | Whole Thread | Download mbox | Resend email |
Thread: | |
Lists: | pgsql-hackers |
On Wed, 2021-01-20 at 12:58 +0100, Daniel Gustafsson wrote:
> Aha, that was a good clue, I had overlooked the required extensions in the CSR.
> Re-reading RFC 5280 it seems we need keyEncipherment, dataEncipherment and
> digitalSignature to create a valid SSL Server certificate. Adding those indeed
> make the test pass. Skimming the certutil code *I think* removing it as you
> did cause a set of defaults to kick in that made it work based on the parameter
> "--nsCertType sslServer", but it's not entirely easy to make out.
Lovely. I didn't expect *removing* an extension to effectively *add*
more, but I'm glad it works now.
==
To continue the Subject Common Name discussion [1] from a different
part of the thread:
Attached is a v23 version of the patchset that peels the raw Common
Name out from a client cert's Subject. This allows the following cases
that the OpenSSL implementation currently handles:
- subjects that don't begin with a CN
- subjects with quotable characters
- subjects that have no CN at all
Embedded NULLs are now handled in a similar manner to the OpenSSL side,
though because this failure happens during the certificate
authentication callback, it results in a TLS alert rather than simply
closing the connection.
For easier review of just the parts I've changed, I've also attached a
since-v22.diff, which is part of the 0001 patch.
--Jacob
[1]
https://www.postgresql.org/message-id/7d6a23a7e30540b486abc823f7ced7a93e1da1e8.camel%40vmware.com
Attachment | Content-Type | Size |
---|---|---|
since-v22.diff | text/x-patch | 4.9 KB |
v23-0001-NSS-Frontend-Backend-and-build-infrastructure.patch | text/x-patch | 116.2 KB |
v23-0002-NSS-Testharness-updates.patch | text/x-patch | 56.9 KB |
v23-0003-NSS-pg_strong_random-support.patch | text/x-patch | 3.8 KB |
v23-0004-NSS-Documentation.patch | text/x-patch | 19.8 KB |
v23-0005-NSS-contrib-modules.patch | text/x-patch | 29.9 KB |
v23-0006-NSS-cryptohash-support.patch | text/x-patch | 6.5 KB |
From | Date | Subject | |
---|---|---|---|
Next Message | Robert Haas | 2021-01-20 17:08:41 | strange error reporting |
Previous Message | Tom Lane | 2021-01-20 16:50:14 | Re: Odd, intermittent failure in contrib/pageinspect |