Commit b6360aa4 authored by Daniel Gustafsson's avatar Daniel Gustafsson

Doc: Fix misleading wording of CRL parameters

ssl_crl_file and ssl_crl_dir are both used to for client certificate
revocation, not server certificates.  The description for the params
could be easily misread to mean the opposite however,  as evidenced
by the bugreport leading to this fix.  Similarly, expand sslcrl and
and sslcrldir to explicitly mention server certificates. While there
also mention sslcrldir where previously only sslcrl was discussed.

Backpatch down to v10, with the CRL dir fixes down to 14 where they
were introduced.

Author: Kyotaro Horiguchi <horikyota.ntt@gmail.com>
Reviewed-by: default avatarPeter Eisentraut <peter.eisentraut@enterprisedb.com>
Discussion: https://postgr.es/m/20211202.135441.590555657708629486.horikyota.ntt@gmail.com
Discussion: https://postgr.es/m/CABWY_HCBUCjY1EJHrEGePGEaSZ5b29apgTohCyygtsqe_ySYng@mail.gmail.com
Backpatch-through: 10
parent 5cb86a26
......@@ -1248,7 +1248,7 @@ include_dir 'conf.d'
</term>
<listitem>
<para>
Specifies the name of the file containing the SSL server certificate
Specifies the name of the file containing the SSL client certificate
revocation list (CRL).
Relative paths are relative to the data directory.
This parameter can only be set in the <filename>postgresql.conf</filename>
......@@ -1267,7 +1267,7 @@ include_dir 'conf.d'
</term>
<listitem>
<para>
Specifies the name of the directory containing the SSL server
Specifies the name of the directory containing the SSL client
certificate revocation list (CRL). Relative paths are relative to the
data directory. This parameter can only be set in
the <filename>postgresql.conf</filename> file or on the server command
......
......@@ -1742,7 +1742,7 @@ postgresql://%2Fvar%2Flib%2Fpostgresql/dbname
<term><literal>sslcrl</literal></term>
<listitem>
<para>
This parameter specifies the file name of the SSL certificate
This parameter specifies the file name of the SSL server certificate
revocation list (CRL). Certificates listed in this file, if it
exists, will be rejected while attempting to authenticate the
server's certificate. If neither
......@@ -1758,7 +1758,7 @@ postgresql://%2Fvar%2Flib%2Fpostgresql/dbname
<term><literal>sslcrldir</literal></term>
<listitem>
<para>
This parameter specifies the directory name of the SSL certificate
This parameter specifies the directory name of the SSL server certificate
revocation list (CRL). Certificates listed in the files in this
directory, if it exists, will be rejected while attempting to
authenticate the server's certificate.
......@@ -8374,6 +8374,8 @@ ldap://ldap.acme.com/cn=dbserver,cn=hosts?pgconnectinfo?base?(objectclass=*)
setting
the connection parameters <literal>sslrootcert</literal> and <literal>sslcrl</literal>
or the environment variables <envar>PGSSLROOTCERT</envar> and <envar>PGSSLCRL</envar>.
<literal>sslcrldir</literal> or the environment variable <envar>PGSSLCRLDIR</envar>
can also be used to specify a directory containing CRL files.
</para>
<note>
......
......@@ -2340,7 +2340,8 @@ pg_dumpall -p 5432 | psql -d postgres -p 5433
you wish to avoid storing them on clients (assuming the root and
intermediate certificates were created with <literal>v3_ca</literal>
extensions). Certificate Revocation List (CRL) entries are also
checked if the parameter <xref linkend="guc-ssl-crl-file"/> is set.
checked if the parameter <xref linkend="guc-ssl-crl-file"/> or
<xref linkend="guc-ssl-crl-dir"/> is set.
</para>
<para>
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment