Univention Bugzilla – Bug 38086
Missing UCS-CA integration
Last modified: 2019-01-03 07:16:59 CET
A newly installed univention-postgres uses the snakeoil-CA instead of the UCS-CA: # find /var/lib/postgresql/ -name server.\* -ls 396410 0 lrwxrwxrwx 1 root root 36 Mär 19 11:51 /var/lib/postgresql/8.4/main/server.crt -> /etc/ssl/certs/ssl-cert-snakeoil.pem 396417 0 lrwxrwxrwx 1 root root 38 Mär 19 11:51 /var/lib/postgresql/8.4/main/server.key -> /etc/ssl/private/ssl-cert-snakeoil.key Those symlins are created by "/usr/bin/pg_createcluster" if "/etc/ssl/certs/ssl-cert-snakeoil.pem" exists, which is created when installing the package "ssl-cert", which "postfix" and "postgresql-*" depend on. See <http://www.postgresql.org/docs/9.1/static/ssl-tcp.html> for more information about setting up PostgreSQL for SSL. FYI: /etc/postgresql-common/root.crt is only required for client-side authentication with SSL.
This issue has been filled against UCS 4.0. The maintenance with bug and security fixes for UCS 4.0 has ended on 31st of May 2016. Customers still on UCS 4.0 are encouraged to update to UCS 4.3. Please contact your partner or Univention for any questions. If this issue still occurs in newer UCS versions, please use "Clone this bug" or simply reopen the issue. In this case please provide detailed information on how this issue is affecting you.