Database Can't Use My SSL Certificates

carlosinfl · 04-19-2011, 09:41 AM

I've installed PostgreSQL on Arch Linux & also self generated self signed certificates in /etc/ssl/ directory. My PostgreSQL 'data' directory is /var/lib/postgres/data & I've edited my postgresql.conf file to use SSL however I'm having permission / access problems starting my database using SSL. It can't access the certificates and errors out when I try and start the database engine:

Code:

LOG:  autovacuum launcher shutting down
LOG:  shutting down
LOG:  database system is shut down
FATAL:  could not load server certificate file "server.crt": No such file or directory
FATAL:  private key file "server.key" has group or world access
DETAIL:  Permissions should be u=rw (0600) or less.
FATAL:  could not access private key file "server.key": Permission denied
FATAL:  could not access private key file "server.key": Permission denied
FATAL:  could not access private key file "server.key": Permission denied
FATAL:  could not load private key file "server.key": Permission denied

My /etc/ssl permissions are as follows:

Code:

[root@ghost ssl]# ls -l
total 28
drwxr-xr-x 2 root root  4096 Apr 18 22:28 certs
drwxr-xr-x 2 root root  4096 Feb  8 13:58 misc
-rw-r--r-- 1 root root 10819 Feb  8 13:58 openssl.cnf
drwxr-xr-x 2 root root  4096 Apr 18 22:28 private
-rw-r--r-- 1 root root  1813 Apr 18 22:27 server.csr

The individual certificate permissions are as follows:

Code:

[root@ghost ssl]# ls -l certs/server.crt 
-rw-r--r-- 1 root root 2126 Apr 18 22:27 certs/server.crt
[root@ghost ssl]# ls -l private/server.key 
-rw------- 1 root root 3311 Apr 18 22:25 private/server.key

I don't know what I need to chown or chmod in order to get PostgreSQL to access my self signed certificates. If anyone could please help me out, I would greatly appreciate it.

ozanbaba · 04-19-2011, 03:32 PM

Quote:

FATAL: private key file "server.key" has group or world access

ssl will never ever touch something with world readable cert at all. change it to 600.

carlosinfl · 04-20-2011, 09:48 AM

Quote:

Originally Posted by ozanbaba

ssl will never ever touch something with world readable cert at all. change it to 600.

The certificates or the symbolic links? My certificates and parent directories are as follows:

Code:

[root@ghost ssl]# pwd
/etc/ssl

[root@ghost ssl]# ls -l
total 28
drwxr-xr-x 2 root root  4096 Apr 19 13:27 certs
drwxr-xr-x 2 root root  4096 Feb  8 13:58 misc
-rw-r--r-- 1 root root 10819 Feb  8 13:58 openssl.cnf
drwx------ 2 root root  4096 Apr 19 13:27 private
-rw-r--r-- 1 root root  1115 Apr 19 13:22 server.csr
[root@ghost ssl]# cd certs/

[root@ghost certs]# ls -l
total 8
-rw-r--r-- 1 root root 2439 Apr 19 13:27 ghost_ssl.crt

[root@ghost certs]# ls -l ../private/ghost_ssl.key 
-rw------- 1 postgres postgres 1704 Apr 19 13:22 ../private/ghost_ssl.key

ozanbaba · 04-20-2011, 11:58 AM

I'm talking about certs. SSL will refuse to use a private cert with world or group readable.