I have inherited a Company Postgres Server with SSL clients. Its around 100 users so far.
Two Problems: My Ca Cert (root.crt) expires next year and it seems to be still TlsV1.0. So an upgrade(renew) is urgently needed.
What I should avoid is making new client certificates for all users in one. It would become a nightmare for me :-)
So I searched for a solution where old and new Certificats will work, until all old certs are expired. I fond a hell of hints (also on Serverfault), but nothing worked so far.
What I did so far: I use old ca key (rootCa.key) and created a new root.crt), and I used old server key (server.key) to create a new server.crt. I installed revocation list (root.crl),root.crt, server.crt and server.key on my Postgres Backup Server.
I can connect with newUser.crt certificate, but not with old ones....as I expected.
I did search the web like hell and found a hint to merge old and new Certificates on the server. So I combined the certs with cat: cat oldRoot.crt >> root.crt for the other files as well. Revocation list didn't work, so I commented the Line: #ssl_crl_file = in Postgres.conf. Seems Postgres works also without revocation list.
Result: Depending wich certificate comes first in server.crt, I could connect with old or with new certs, but never with both. To test it, I used merged root.crt with oldServer.cert and also with newServer.cert. Both worked with new or old.
That means, a merged root.crt ist working fine, but not a merged server.crt.
I checked it with openssl and merged root.crt and merged server.crt: openssl verify -verbose -x509_strict -CAfile root.crt -CApath . old_cert.crt server.crt old_cert.crt: OK server.crt: OK
openssl verify -verbose -x509_strict -CAfile root.crt -CApath . new_cert.crt server.crt new_cert.crt: OK server.crt: OK
It seems openssl can manage merged certificates, but not Postgres.
Any idea how to solve this problem?
Any hint is appreciated.
Regards Schlauchi
server: Ubuntu 2104, Postgres13 backup server: Ubuntu 1604, Postgres13