From e2ebc90eb8090def69b2d3aa86f6caf3a8026f6b Mon Sep 17 00:00:00 2001 From: Daniel Gustafsson Date: Fri, 3 Dec 2021 14:15:50 +0100 Subject: [PATCH] Doc: Fix misleading wording of CRL parameters ssl_crl_file and ssl_crl_dir are both used to for client certificate revocation, not server certificates. The description for the params could be easily misread to mean the opposite however, as evidenced by the bugreport leading to this fix. Similarly, expand sslcrl and and sslcrldir to explicitly mention server certificates. While there also mention sslcrldir where previously only sslcrl was discussed. Backpatch down to v10, with the CRL dir fixes down to 14 where they were introduced. Author: Kyotaro Horiguchi Reviewed-by: Peter Eisentraut Discussion: https://postgr.es/m/20211202.135441.590555657708629486.horikyota.ntt@gmail.com Discussion: https://postgr.es/m/CABWY_HCBUCjY1EJHrEGePGEaSZ5b29apgTohCyygtsqe_ySYng@mail.gmail.com Backpatch-through: 10 --- doc/src/sgml/config.sgml | 2 +- doc/src/sgml/libpq.sgml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/doc/src/sgml/config.sgml b/doc/src/sgml/config.sgml index b2018d9763..cbc2653b96 100644 --- a/doc/src/sgml/config.sgml +++ b/doc/src/sgml/config.sgml @@ -1189,7 +1189,7 @@ include_dir 'conf.d' - Specifies the name of the file containing the SSL server certificate + Specifies the name of the file containing the SSL client certificate revocation list (CRL). Relative paths are relative to the data directory. This parameter can only be set in the postgresql.conf diff --git a/doc/src/sgml/libpq.sgml b/doc/src/sgml/libpq.sgml index 5abba1ca5f..57d95d2020 100644 --- a/doc/src/sgml/libpq.sgml +++ b/doc/src/sgml/libpq.sgml @@ -1729,7 +1729,7 @@ postgresql://%2Fvar%2Flib%2Fpostgresql/dbname sslcrl - This parameter specifies the file name of the SSL certificate + This parameter specifies the file name of the SSL server certificate revocation list (CRL). Certificates listed in this file, if it exists, will be rejected while attempting to authenticate the server's certificate. The default is