Skip to content

Updated docs for PEM format support #18635

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mosabua merged 1 commit into from
Aug 31, 2023
Merged

Updated docs for PEM format support #18635

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion docs/src/main/sphinx/security/inspect-pem.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -52,7 +52,8 @@ MIIEowIBAAKCAQEAwJL8CLeDFAHhZe3QOOF1vWt4Vuk9vyO38Y1y9SgBfB02b2jW
If your key section reports `BEGIN ENCRYPTED PRIVATE KEY` instead, this means
the key is encrypted and you must use the password to open or inspect the key.
You may have specified the password when requesting the key, or the password
could be assigned by your site's network managers.
could be assigned by your site's network managers. Note that password protected
PEM files are not supported by Trino.

If your key section reports `BEGIN EC PRIVATE KEY` or `BEGIN DSA PRIVATE
KEY`, this designates a key using Elliptical Curve or DSA alternatives to RSA.
Expand Down Expand Up @@ -107,6 +108,7 @@ openssl x509 -in clustercoord.pem -text -noout
```

If your certificate was generated with a password, `openssl` prompts for it.
Note that password protected PEM files are not supported by Trino.

In the output of the `openssl` command, look for the following
characteristics:
Expand Down
5 changes: 2 additions & 3 deletions docs/src/main/sphinx/security/tls.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -220,9 +220,8 @@ http-server.https.keystore.path=/usr/local/certs/clustercoord.p12
Relative paths are relative to the Trino server's root directory. In a
`tar.gz` installation, the root directory is one level above `etc`.

JKS keystores always require a password, while PEM format certificates can
optionally require a password. For cases where you need a password, add the
following line to the configuration.
JKS keystores always require a password, while PEM files with passwords are not
supported by Trino. For JKS, add the following line to the configuration:

```text
http-server.https.keystore.key=<keystore-password>
Expand Down