I am running PostgreSQL 9 on Ubuntu (from their PPA repository). I am using OpenSSL 0.9.8o.
I have generated keys and certificates using TinyCA2 for both a pg server and the psql client. I essentially followed the instructions.
My pg_hba.conf file is configured with this:
hostssl all abc ::1/128 cert clientcert=1
I have put the root certificate generated by TinyCA along with the server's certificate and key in the DATA directory as follows.
sudo unzip database_server.zip
sudo mv sudo mv cacert.pem root.crt
sudo mv cert.pem server.crt
sudo openssl rsa -in key.pem -out server.key
sudo chmod 0600 server.key
sudo chmod ga=r root.crt
sudo chown postgres:postgres root.crt server.key server.crt
Yet I am unable to start the server. This is what I get on startup:
$ sudo /etc/init.d/postgresql start 9.0
* Starting PostgreSQL 9.0 database server
* The PostgreSQL server failed to start. Please check the log output:
2011-03-17 16:39:13 IST LOG: client certificates can only be checked if a root certificate store is available
2011-03-17 16:39:13 IST HINT: Make sure the root.crt file is present and readable.
2011-03-17 16:39:13 IST CONTEXT: line 93 of configuration file "/etc/postgresql/9.0/main/pg_hba.conf"
2011-03-17 16:39:13 IST FATAL: could not load pg_hba.conf
Interestingly, the root.crt file is very much present and readable:
$ ll
<snip>
-rw-r--r-- 1 postgres postgres 143 2010-12-01 17:06 pg_ctl.conf
-rw-r----- 1 postgres postgres 4.3K 2011-03-17 16:35 pg_hba.conf
-rw-r----- 1 postgres postgres 1.7K 2011-03-17 15:58 pg_ident.conf
-rw-r--r-- 1 postgres postgres 18K 2011-02-07 18:38 postgresql.conf
-rw-r--r-- 1 postgres postgres 2.8K 2011-03-17 16:39 root.crt
-rw------- 1 postgres postgres 2.2K 2011-03-17 14:37 server.crt
-rw------- 1 postgres postgres 891 2011-03-17 16:18 server.key
-rw------- 1 postgres postgres 963 2011-03-17 14:37 server.key.encrypted
What is going on? What do I have to do for this certificate to load???