diff options
Diffstat (limited to 'doc/src')
| -rw-r--r-- | doc/src/sgml/config.sgml | 36 | ||||
| -rw-r--r-- | doc/src/sgml/libpq.sgml | 28 |
2 files changed, 62 insertions, 2 deletions
diff --git a/doc/src/sgml/config.sgml b/doc/src/sgml/config.sgml index 4df1405d2e2..e81141e45cf 100644 --- a/doc/src/sgml/config.sgml +++ b/doc/src/sgml/config.sgml @@ -1216,7 +1216,41 @@ include_dir 'conf.d' Relative paths are relative to the data directory. This parameter can only be set in the <filename>postgresql.conf</filename> file or on the server command line. - The default is empty, meaning no CRL file is loaded. + The default is empty, meaning no CRL file is loaded (unless + <xref linkend="guc-ssl-crl-dir"/> is set). + </para> + </listitem> + </varlistentry> + + <varlistentry id="guc-ssl-crl-dir" xreflabel="ssl_crl_dir"> + <term><varname>ssl_crl_dir</varname> (<type>string</type>) + <indexterm> + <primary><varname>ssl_crl_dir</varname> configuration parameter</primary> + </indexterm> + </term> + <listitem> + <para> + Specifies the name of the directory containing the SSL server + certificate revocation list (CRL). Relative paths are relative to the + data directory. This parameter can only be set in + the <filename>postgresql.conf</filename> file or on the server command + line. The default is empty, meaning no CRLs are used (unless + <xref linkend="guc-ssl-crl-file"/> is set). + </para> + + <para> + The directory needs to be prepared with the OpenSSL command + <literal>openssl rehash</literal> or <literal>c_rehash</literal>. See + its documentation for details. + </para> + + <para> + When using this setting, CRLs in the specified directory are loaded + on-demand at connection time. New CRLs can be added to the directory + and will be used immediately. This is unlike <xref + linkend="guc-ssl-crl-file"/>, which causes the CRL in the file to be + loaded at server start time or when the configuration is reloaded. + Both settings can be used together. </para> </listitem> </varlistentry> diff --git a/doc/src/sgml/libpq.sgml b/doc/src/sgml/libpq.sgml index b7a82453f0d..5e25f20843c 100644 --- a/doc/src/sgml/libpq.sgml +++ b/doc/src/sgml/libpq.sgml @@ -1723,12 +1723,38 @@ postgresql://%2Fvar%2Flib%2Fpostgresql/dbname This parameter specifies the file name of the SSL certificate revocation list (CRL). Certificates listed in this file, if it exists, will be rejected while attempting to authenticate the - server's certificate. The default is + server's certificate. If neither + <xref linkend='libpq-connect-sslcrl'/> nor + <xref linkend='libpq-connect-sslcrldir'/> is set, this setting is + taken as <filename>~/.postgresql/root.crl</filename>. </para> </listitem> </varlistentry> + <varlistentry id="libpq-connect-sslcrldir" xreflabel="sslcrldir"> + <term><literal>sslcrldir</literal></term> + <listitem> + <para> + This parameter specifies the directory name of the SSL certificate + revocation list (CRL). Certificates listed in the files in this + directory, if it exists, will be rejected while attempting to + authenticate the server's certificate. + </para> + + <para> + The directory needs to be prepared with the OpenSSL command + <literal>openssl rehash</literal> or <literal>c_rehash</literal>. See + its documentation for details. + </para> + + <para> + Both <literal>sslcrl</literal> and <literal>sslcrldir</literal> can be + specified together. + </para> + </listitem> + </varlistentry> + <varlistentry id="libpq-connect-requirepeer" xreflabel="requirepeer"> <term><literal>requirepeer</literal></term> <listitem> |