From dd92d6cdb79ab40b76ee9681011c3e74c5bc7002 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Greg=20Kar=C3=A9kinian?= Date: Thu, 14 May 2020 13:14:42 +0200 Subject: [PATCH] Remove deploying the root cert to clients from the README We do not want to verify the root cert so this is not needed --- site-cookbooks/kosmos-postgresql/README.md | 17 ----------------- 1 file changed, 17 deletions(-) diff --git a/site-cookbooks/kosmos-postgresql/README.md b/site-cookbooks/kosmos-postgresql/README.md index 21ae024..2541424 100644 --- a/site-cookbooks/kosmos-postgresql/README.md +++ b/site-cookbooks/kosmos-postgresql/README.md @@ -55,20 +55,3 @@ The content of `server.crt`, `server.key` and `root.crt` an stored in the `postgresql` encrypted data bag. The root key is stored in LastPass ("Self-signed TLS root certificate"). `server.crt` & `server.key` are used by the PostgreSQL server. - -The root certificate needs to be deployed to clients so they verify the cert -can be trusted. - -For example: - -```ruby -postgresql_data_bag_item = data_bag_item('credentials', 'postgresql') -root_cert_path = "/etc/ssl/certs/root.kosmos.org.crt" -file root_cert_path do - content postgresql_data_bag_item['ssl_root_cert'] - mode "0644" -end -``` - -`/etc/ssl/certs/root.kosmos.org.crt` can be used as the CA root cert path in -the client's configuration