solved: SSL mode with Intermediate Certificate Authorities and CRLS

Thursday, December 20. 2012

solved: SSL mode with Intermediate Certificate Authorities and CRLS

My many thanks to Radu Radutiu who has found the solution to my SSL problem. It turns out that if you use a CRL file it needs to contain a CRL (even if it's only empty) for every CA in the chain of CAs. We need to document this.

Posted by Andrew Dunstan in PostgreSQL at 17:54 | Comment (1) | Trackbacks (0)

Trackbacks

Trackback specific URI for this entry

No Trackbacks

Comments

Display comments as (Linear | Threaded)

One should also make sure that the CRLs are always valid. If any CRL in the chain is expired or considered invalid (e.g. contains an invalid revocation reason) the authentication will fail. This becomes a major issue if you are using an external CA with a very short CRL lifetime (like 24 or 48 h).

#1 Radu Radutiu on 2012-12-21 10:54 (Reply)

Add Comment