Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commita445cb9

Browse files
committed
Add parameters for controlling locations of server-side SSL files
This allows changing the location of the files that were previouslyhard-coded to server.crt, server.key, root.crt, root.crl.server.crt and server.key continue to be the default settings and arethus required to be present by default if SSL is enabled. But thesettings for the server-side CA and CRL are now empty by default, andif they are set, the files are required to be present. This replacesthe previous behavior of ignoring the functionality if the files werenot found.
1 parenta417f85 commita445cb9

File tree

7 files changed

+179
-80
lines changed

7 files changed

+179
-80
lines changed

‎doc/src/sgml/config.sgml

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -668,6 +668,70 @@ SET ENABLE_SEQSCAN TO OFF;
668668
</listitem>
669669
</varlistentry>
670670

671+
<varlistentry id="guc-ssl-ca-file" xreflabel="ssl_ca_file">
672+
<term><varname>ssl_ca_file</varname> (<type>string</type>)</term>
673+
<indexterm>
674+
<primary><varname>ssl_ca_file</> configuration parameter</primary>
675+
</indexterm>
676+
<listitem>
677+
<para>
678+
Specifies the name of the file containing the SSL server certificate
679+
authority (CA). The default is empty, meaning no CA file is loaded,
680+
and client certificate verification is not performed. (In previous
681+
releases of PostgreSQL, the name of this file was hard-coded
682+
as <filename>root.crt</filename>.) Relative paths are relative to the
683+
data directory. This parameter can only be set at server start.
684+
</para>
685+
</listitem>
686+
</varlistentry>
687+
688+
<varlistentry id="guc-ssl-cert-file" xreflabel="ssl_cert_file">
689+
<term><varname>ssl_cert_file</varname> (<type>string</type>)</term>
690+
<indexterm>
691+
<primary><varname>ssl_cert_file</> configuration parameter</primary>
692+
</indexterm>
693+
<listitem>
694+
<para>
695+
Specifies the name of the file containing the SSL server certificate.
696+
The default is <filename>server.crt</filename>. Relative paths are
697+
relative to the data directory. This parameter can only be set at
698+
server start.
699+
</para>
700+
</listitem>
701+
</varlistentry>
702+
703+
<varlistentry id="guc-ssl-crl-file" xreflabel="ssl_crl_file">
704+
<term><varname>ssl_crl_file</varname> (<type>string</type>)</term>
705+
<indexterm>
706+
<primary><varname>ssl_crl_file</> configuration parameter</primary>
707+
</indexterm>
708+
<listitem>
709+
<para>
710+
Specifies the name of the file containing the SSL server certificate
711+
revocation list (CRL). The default is empty, meaning no CRL file is
712+
loaded. (In previous releases of PostgreSQL, the name of this file was
713+
hard-coded as <filename>root.crl</filename>.) Relative paths are
714+
relative to the data directory. This parameter can only be set at
715+
server start.
716+
</para>
717+
</listitem>
718+
</varlistentry>
719+
720+
<varlistentry id="guc-ssl-key-file" xreflabel="ssl_key_file">
721+
<term><varname>ssl_key_file</varname> (<type>string</type>)</term>
722+
<indexterm>
723+
<primary><varname>ssl_key_file</> configuration parameter</primary>
724+
</indexterm>
725+
<listitem>
726+
<para>
727+
Specifies the name of the file containing the SSL server private key.
728+
The default is <filename>server.key</filename>. Relative paths are
729+
relative to the data directory. This parameter can only be set at
730+
server start.
731+
</para>
732+
</listitem>
733+
</varlistentry>
734+
671735
<varlistentry id="guc-ssl-renegotiation-limit" xreflabel="ssl_renegotiation_limit">
672736
<term><varname>ssl_renegotiation_limit</varname> (<type>integer</type>)</term>
673737
<indexterm>

‎doc/src/sgml/runtime.sgml

Lines changed: 20 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -1831,10 +1831,8 @@ pg_dumpall -p 5432 | psql -d postgres -p 5433
18311831
SSL certificates and make sure that clients check the server's certificate.
18321832
To do that, the server
18331833
must be configured to accept only <literal>hostssl</> connections (<xref
1834-
linkend="auth-pg-hba-conf">) and have SSL
1835-
<filename>server.key</filename> (key) and
1836-
<filename>server.crt</filename> (certificate) files (<xref
1837-
linkend="ssl-tcp">). The TCP client must connect using
1834+
linkend="auth-pg-hba-conf">) and have SSL key and certificate files
1835+
(<xref linkend="ssl-tcp">). The TCP client must connect using
18381836
<literal>sslmode=verify-ca</> or
18391837
<literal>verify-full</> and have the appropriate root certificate
18401838
file installed (<xref linkend="libpq-connect">).
@@ -2053,10 +2051,12 @@ pg_dumpall -p 5432 | psql -d postgres -p 5433
20532051
</note>
20542052

20552053
<para>
2056-
To start in <acronym>SSL</> mode, the files <filename>server.crt</>
2057-
and <filename>server.key</> must exist in the server's data directory.
2058-
These files should contain the server certificate and private key,
2059-
respectively.
2054+
To start in <acronym>SSL</> mode, files containing the server certificate
2055+
and private key must exist. By default, these files are expected to be
2056+
named <filename>server.crt</> and <filename>server.key</>, respectively, in
2057+
the server's data directory, but other names and locations can be specified
2058+
using the configuration parameters <xref linkend="guc-ssl-cert-file">
2059+
and <xref linkend="guc-ssl-key-file">.
20602060
On Unix systems, the permissions on <filename>server.key</filename> must
20612061
disallow any access to world or group; achieve this by the command
20622062
<command>chmod 0600 server.key</command>.
@@ -2083,15 +2083,17 @@ pg_dumpall -p 5432 | psql -d postgres -p 5433
20832083
To require the client to supply a trusted certificate, place
20842084
certificates of the certificate authorities (<acronym>CA</acronym>s)
20852085
you trust in the file <filename>root.crt</filename> in the data
2086-
directory, and set the <literal>clientcert</literal> parameter
2086+
directory, set the parameter <xref linkend="guc-ssl-ca-file"> in
2087+
<filename>postgresql.conf</filename> to <literal>root.crt</literal>,
2088+
and set the <literal>clientcert</literal> parameter
20872089
to 1 on the appropriate <literal>hostssl</> line(s) in
20882090
<filename>pg_hba.conf</>.
20892091
A certificate will then be requested from the client during
20902092
SSL connection startup. (See <xref linkend="libpq-ssl"> for a
20912093
description of how to set up certificates on the client.) The server will
20922094
verify that the client's certificate is signed by one of the trusted
20932095
certificate authorities. Certificate Revocation List (CRL) entries
2094-
are also checked if thefile <filename>root.crl</filename> exists.
2096+
are also checked if theparameter <xref linkend="guc-ssl-crl-file"> is set.
20952097
<!-- If this URL changes replace it with a URL to www.archive.org. -->
20962098
(See <ulink
20972099
url="http://h71000.www7.hp.com/DOC/83final/BA554_90007/ch04s02.html"></>
@@ -2103,7 +2105,7 @@ pg_dumpall -p 5432 | psql -d postgres -p 5433
21032105
available for all authentication methods, but only for rows specified as
21042106
<literal>hostssl</>. When <literal>clientcert</literal> is not specified
21052107
or is set to 0, the server will still verify presented client
2106-
certificates against<filename>root.crt</filename>ifthat file exists
2108+
certificates againstits CA list,ifone is configured,
21072109
&mdash; but it will not insist that a client certificate be presented.
21082110
</para>
21092111

@@ -2127,7 +2129,8 @@ pg_dumpall -p 5432 | psql -d postgres -p 5433
21272129

21282130
<para>
21292131
<xref linkend="ssl-file-usage"> summarizes the files that are
2130-
relevant to the SSL setup on the server.
2132+
relevant to the SSL setup on the server. (The shown file names are default
2133+
or typical names. The locally configured names could be different.)
21312134
</para>
21322135

21332136
<table id="ssl-file-usage">
@@ -2144,27 +2147,27 @@ pg_dumpall -p 5432 | psql -d postgres -p 5433
21442147
<tbody>
21452148

21462149
<row>
2147-
<entry><filename>$PGDATA/server.crt</></entry>
2150+
<entry><xref linkend="guc-ssl-cert-file"> (<filename>$PGDATA/server.crt</>)</entry>
21482151
<entry>server certificate</entry>
21492152
<entry>sent to client to indicate server's identity</entry>
21502153
</row>
21512154

21522155
<row>
2153-
<entry><filename>$PGDATA/server.key</></entry>
2156+
<entry><xref linkend="guc-ssl-key-file"> (<filename>$PGDATA/server.key</>)</entry>
21542157
<entry>server private key</entry>
21552158
<entry>proves server certificate was sent by the owner; does not indicate
21562159
certificate owner is trustworthy</entry>
21572160
</row>
21582161

21592162
<row>
2160-
<entry><filename>$PGDATA/root.crt</></entry>
2163+
<entry><xref linkend="guc-ssl-ca-file"> (<filename>$PGDATA/root.crt</>)</entry>
21612164
<entry>trusted certificate authorities</entry>
21622165
<entry>checks that client certificate is
21632166
signed by a trusted certificate authority</entry>
21642167
</row>
21652168

21662169
<row>
2167-
<entry><filename>$PGDATA/root.crl</></entry>
2170+
<entry><xref linkend="guc-ssl-crl-file"> (<filename>$PGDATA/root.crl</>)</entry>
21682171
<entry>certificates revoked by certificate authorities</entry>
21692172
<entry>client certificate must not be on this list</entry>
21702173
</row>
@@ -2176,6 +2179,7 @@ pg_dumpall -p 5432 | psql -d postgres -p 5433
21762179
<para>
21772180
The files <filename>server.key</>, <filename>server.crt</>,
21782181
<filename>root.crt</filename>, and <filename>root.crl</filename>
2182+
(or their configured alternative names)
21792183
are only examined during server start; so you must restart
21802184
the server for changes in them to take effect.
21812185
</para>

‎src/backend/libpq/be-secure.c

Lines changed: 44 additions & 63 deletions
Original file line numberDiff line numberDiff line change
@@ -77,10 +77,10 @@
7777

7878
#ifdefUSE_SSL
7979

80-
#defineROOT_CERT_FILE"root.crt"
81-
#defineROOT_CRL_FILE"root.crl"
82-
#defineSERVER_CERT_FILE"server.crt"
83-
#defineSERVER_PRIVATE_KEY_FILE "server.key"
80+
char*ssl_cert_file;
81+
char*ssl_key_file;
82+
char*ssl_ca_file;
83+
char*ssl_crl_file;
8484

8585
staticDH*load_dh_file(intkeylength);
8686
staticDH*load_dh_buffer(constchar*,size_t);
@@ -746,17 +746,17 @@ initialize_SSL(void)
746746
* Load and verify server's certificate and private key
747747
*/
748748
if (SSL_CTX_use_certificate_chain_file(SSL_context,
749-
SERVER_CERT_FILE)!=1)
749+
ssl_cert_file)!=1)
750750
ereport(FATAL,
751751
(errcode(ERRCODE_CONFIG_FILE_ERROR),
752752
errmsg("could not load server certificate file \"%s\": %s",
753-
SERVER_CERT_FILE,SSLerrmessage())));
753+
ssl_cert_file,SSLerrmessage())));
754754

755-
if (stat(SERVER_PRIVATE_KEY_FILE,&buf)!=0)
755+
if (stat(ssl_key_file,&buf)!=0)
756756
ereport(FATAL,
757757
(errcode_for_file_access(),
758758
errmsg("could not access private key file \"%s\": %m",
759-
SERVER_PRIVATE_KEY_FILE)));
759+
ssl_key_file)));
760760

761761
/*
762762
* Require no public access to key file.
@@ -771,16 +771,16 @@ initialize_SSL(void)
771771
ereport(FATAL,
772772
(errcode(ERRCODE_CONFIG_FILE_ERROR),
773773
errmsg("private key file \"%s\" has group or world access",
774-
SERVER_PRIVATE_KEY_FILE),
774+
ssl_key_file),
775775
errdetail("Permissions should be u=rw (0600) or less.")));
776776
#endif
777777

778778
if (SSL_CTX_use_PrivateKey_file(SSL_context,
779-
SERVER_PRIVATE_KEY_FILE,
779+
ssl_key_file,
780780
SSL_FILETYPE_PEM)!=1)
781781
ereport(FATAL,
782782
(errmsg("could not load private key file \"%s\": %s",
783-
SERVER_PRIVATE_KEY_FILE,SSLerrmessage())));
783+
ssl_key_file,SSLerrmessage())));
784784

785785
if (SSL_CTX_check_private_key(SSL_context)!=1)
786786
ereport(FATAL,
@@ -797,48 +797,30 @@ initialize_SSL(void)
797797
elog(FATAL,"could not set the cipher list (no valid ciphers available)");
798798

799799
/*
800-
* Attempt to load CA store, so we can verify client certificates if
801-
* needed.
800+
* Load CA store, so we can verify client certificates if needed.
802801
*/
803-
ssl_loaded_verify_locations= false;
804-
805-
if (access(ROOT_CERT_FILE,R_OK)!=0)
802+
if (ssl_ca_file[0])
806803
{
807-
/*
808-
* If root certificate file simply not found, don't log an error here,
809-
* because it's quite likely the user isn't planning on using client
810-
* certificates. If we can't access it for other reasons, it is an
811-
* error.
812-
*/
813-
if (errno!=ENOENT)
804+
if (SSL_CTX_load_verify_locations(SSL_context,ssl_ca_file,NULL)!=1||
805+
(root_cert_list=SSL_load_client_CA_file(ssl_ca_file))==NULL)
814806
ereport(FATAL,
815-
(errmsg("could notaccess root certificate file \"%s\": %m",
816-
ROOT_CERT_FILE)));
807+
(errmsg("could notload root certificate file \"%s\": %s",
808+
ssl_ca_file,SSLerrmessage())));
817809
}
818-
elseif (SSL_CTX_load_verify_locations(SSL_context,ROOT_CERT_FILE,NULL)!=1||
819-
(root_cert_list=SSL_load_client_CA_file(ROOT_CERT_FILE))==NULL)
820-
{
821-
/*
822-
* File was there, but we could not load it. This means the file is
823-
* somehow broken, and we cannot do verification at all - so fail.
824-
*/
825-
ereport(FATAL,
826-
(errmsg("could not load root certificate file \"%s\": %s",
827-
ROOT_CERT_FILE,SSLerrmessage())));
828-
}
829-
else
810+
811+
/*----------
812+
* Load the Certificate Revocation List (CRL).
813+
* http://searchsecurity.techtarget.com/sDefinition/0,,sid14_gci803160,00.html
814+
*----------
815+
*/
816+
if (ssl_crl_file[0])
830817
{
831-
/*----------
832-
* Load the Certificate Revocation List (CRL) if file exists.
833-
* http://searchsecurity.techtarget.com/sDefinition/0,,sid14_gci803160,00.html
834-
*----------
835-
*/
836818
X509_STORE*cvstore=SSL_CTX_get_cert_store(SSL_context);
837819

838820
if (cvstore)
839821
{
840822
/* Set the flags to check against the complete CRL chain */
841-
if (X509_STORE_load_locations(cvstore,ROOT_CRL_FILE,NULL)==1)
823+
if (X509_STORE_load_locations(cvstore,ssl_crl_file,NULL)==1)
842824
{
843825
/* OpenSSL 0.96 does not support X509_V_FLAG_CRL_CHECK */
844826
#ifdefX509_V_FLAG_CRL_CHECK
@@ -847,32 +829,31 @@ initialize_SSL(void)
847829
#else
848830
ereport(LOG,
849831
(errmsg("SSL certificate revocation list file \"%s\" ignored",
850-
ROOT_CRL_FILE),
832+
ssl_crl_file),
851833
errdetail("SSL library does not support certificate revocation lists.")));
852834
#endif
853835
}
854836
else
855-
{
856-
/* Not fatal - we do not require CRL */
857-
ereport(LOG,
858-
(errmsg("SSL certificate revocation list file \"%s\" not found, skipping: %s",
859-
ROOT_CRL_FILE,SSLerrmessage()),
860-
errdetail("Certificates will not be checked against revocation list.")));
861-
}
837+
ereport(FATAL,
838+
(errmsg("could not load SSL certificate revocation list file \"%s\": %s",
839+
ssl_crl_file,SSLerrmessage())));
840+
}
841+
}
862842

863-
/*
864-
* Always ask for SSL client cert, but don't fail if it's not
865-
* presented. We might fail such connections later, depending on
866-
* what we find in pg_hba.conf.
867-
*/
868-
SSL_CTX_set_verify(SSL_context,
869-
(SSL_VERIFY_PEER |
870-
SSL_VERIFY_CLIENT_ONCE),
871-
verify_cb);
843+
if (ssl_ca_file[0])
844+
{
845+
/*
846+
* Always ask for SSL client cert, but don't fail if it's not
847+
* presented. We might fail such connections later, depending on
848+
* what we find in pg_hba.conf.
849+
*/
850+
SSL_CTX_set_verify(SSL_context,
851+
(SSL_VERIFY_PEER |
852+
SSL_VERIFY_CLIENT_ONCE),
853+
verify_cb);
872854

873-
/* Set flag to remember CA store is successfully loaded */
874-
ssl_loaded_verify_locations= true;
875-
}
855+
/* Set flag to remember CA store is successfully loaded */
856+
ssl_loaded_verify_locations= true;
876857

877858
/*
878859
* Tell OpenSSL to send the list of root certs we trust to clients in

‎src/backend/libpq/hba.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1417,7 +1417,7 @@ parse_hba_auth_opt(char *name, char *val, HbaLine *hbaline, int line_num)
14171417
ereport(LOG,
14181418
(errcode(ERRCODE_CONFIG_FILE_ERROR),
14191419
errmsg("client certificates can only be checked if a root certificate store is available"),
1420-
errhint("Make sure theroot.crt fileispresent and readable."),
1420+
errhint("Make sure theconfiguration parameter \"ssl_ca_file\"isset."),
14211421
errcontext("line %d of configuration file \"%s\"",
14221422
line_num,HbaFileName)));
14231423
return false;

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp