Re: SSL - automatic entry of certificate passphrase in PostgreSQL 10?

--00000000000072d3e005990ad61e
Content-Type: text/plain; charset="UTF-8"

On Fri, Dec 6, 2019 at 4:22 PM Tom Lane <[email protected]> wrote:

> Martin Goodson <[email protected]> writes:
> > Or am I stuck with either requesting a new certificate without the
> > passphrase or going to PostgreSQL 11?
>
> AFAIK, those are your options.  Pre-v11 there was no reasonable way
> to work with a server cert that requires a passphrase.
>

It should certainly be possible to remove the passphrase permanently from
the received certificate again, no need for a new one. Well, technically
the passphrase is on the key, and you remove it with something like:
openssl rsa -in current.key -out new.key

That'll ask for a passphrase for the old key, and write the new one out
without.

-- 
 Magnus Hagander
 Me: https://www.hagander.net/ <http://www.hagander.net/>
 Work: https://www.redpill-linpro.com/ <http://www.redpill-linpro.com/>

--00000000000072d3e005990ad61e
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div dir=3D"ltr">On Fri, Dec 6, 2019 at 4:22 PM Tom Lane &=
lt;<a href=3D"mailto:[email protected]">[email protected]</a>&gt; wrote:<br=
></div><div class=3D"gmail_quote"><blockquote class=3D"gmail_quote" style=
=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding=
-left:1ex">Martin Goodson &lt;<a href=3D"mailto:[email protected]" ta=
rget=3D"_blank">[email protected]</a>&gt; writes:<br>
&gt; Or am I stuck with either requesting a new certificate without the <br=
>
&gt; passphrase or going to PostgreSQL 11?<br>
<br>
AFAIK, those are your options.=C2=A0 Pre-v11 there was no reasonable way<br=
>
to work with a server cert that requires a passphrase.<br></blockquote><div=
><br></div><div>It should certainly be possible to remove the passphrase pe=
rmanently from the received certificate again, no need for a new one. Well,=
 technically the passphrase is on the key, and you remove it with something=
 like:</div>openssl rsa -in current.key -out new.key</div><div class=3D"gma=
il_quote"><br></div><div class=3D"gmail_quote">That&#39;ll ask for a passph=
rase for the old key, and write the new one out without.</div><div class=3D=
"gmail_quote"><div>=C2=A0</div></div>-- <br><div dir=3D"ltr" class=3D"gmail=
_signature"><div dir=3D"ltr"><div>=C2=A0Magnus Hagander<br>=C2=A0Me: <a hre=
f=3D"http://www.hagander.net/" target=3D"_blank">https://www.hagander.net/<=
/a><br>=C2=A0Work: <a href=3D"http://www.redpill-linpro.com/" target=3D"_bl=
ank">https://www.redpill-linpro.com/</a></div></div></div></div>

--00000000000072d3e005990ad61e--