<!--

$Header: /cvsroot/pgsql/doc/src/sgml/runtime.sgml,v 1.139 2002/09/25 21:16:10 petere Exp $

$Header: /cvsroot/pgsql/doc/src/sgml/runtime.sgml,v 1.140 2002/09/26 04:41:54 momjian Exp $

-->

<Chapter Id="runtime">

Enter the old passphrase to unlock the existing key. Now do

<programlisting>

openssl req -x509 -in cert.req -text -key cert.pem -out cert.cert

chmod og-rwx cert.pem

cp cert.pem <replaceable>$PGDATA</replaceable>/server.key

cp cert.cert <replaceable>$PGDATA</replaceable>/server.crt

</programlisting>

snprintf(fnbuf,sizeoffnbuf,"%s/root.crt",DataDir);

if (!SSL_CTX_load_verify_locations(SSL_context,fnbuf,CA_PATH))

{

return0;

postmaster_error("could not read root cert file (%s): %s",

fnbuf,SSLerrmessage());

ExitPostmaster(1);

}

SSL_CTX_set_verify(SSL_context,

SSL_VERIFY_PEER |SSL_VERIFY_CLIENT_ONCE,verify_cb);

pwd->pw_dir);

if (stat(fnbuf,&buf)==-1)

{

return0;

printfPQExpBuffer(&conn->errorMessage,

libpq_gettext("could not read root certificate list (%s): %s\n"),

fnbuf,strerror(errno));

return-1;

}

if (!SSL_CTX_load_verify_locations(SSL_context,fnbuf,0))

{

close_SSL(conn);

return-1;

}

conn->peer=SSL_get_peer_certificate(conn->ssl);

close_SSL(conn);

return-1;

}

return0;

}