Skip to content

Commit

Permalink
Updated openssl example command (#1763)
Browse files Browse the repository at this point in the history
* docs: update openssl key conversion example command

update openssl example command to reflect the filenames the user likely needs, and to be
consistent with the naming requirements described in the previous sentence. add -nocrypt flag to
the example command. this prevents driver from attempting to ask the user for a password for the
resulting key file (even when the input key did not have a password).

* docs: add note explaining usage of sslpassword with respect to sslkey

Explain that key passwords are provided using sslpassword. Move the mention of the `-nocrypt`
flag to the note for use with password-less key files.
  • Loading branch information
bvanderveen committed Apr 23, 2020
1 parent 2aa49c0 commit e19d458
Showing 1 changed file with 3 additions and 1 deletion.
4 changes: 3 additions & 1 deletion docs/documentation/head/connect.md
Original file line number Diff line number Diff line change
Expand Up @@ -132,7 +132,9 @@ Connection conn = DriverManager.getConnection(url);

*Note:* The key file **must** be in [PKCS-8](https://en.wikipedia.org/wiki/PKCS_8) [DER format](https://wiki.openssl.org/index.php/DER). A PEM key can be converted to DER format using the openssl command:

`openssl pkcs8 -topk8 -inform PEM -in my.key -outform DER -out my.key.der -v1 PBE-MD5-DES`
`openssl pkcs8 -topk8 -inform PEM -in postgresql.key -outform DER -out postgresql.pk8 -v1 PBE-MD5-DES`

If your key has a password, provide it using the `sslpassword` connection parameter described below. Otherwise, you can add the flag `-nocrypt` to the above command to prevent the driver from requesting a password.

*Note:* The use of -v1 PBE-MD5-DES might be inadequate in environments where high level of security is needed and the key is not protected
by other means (e.g. access control of the OS), or the key file is transmitted in untrusted channels.
Expand Down

0 comments on commit e19d458

Please sign in to comment.