PostgreSQL服务器无法启动

Question

I am using PostgreSQL server for my application. I am trying to implement secure connection using SSL certificate. I modified ssl property to "on" in postgresql.conf. I am generate self-signed certificate and key which is encrypted using the below java code, it uses pbe to encrypt the private key.

    byte[] encodedprivkey = privKey.getEncoded();
    String MYPBEALG = "PBEWithSHA1AndDESede";
    String password = "test123";

    int count = 20;// hash iteration count
    Random random = new Random();
    byte[] salt = new byte[8];
    random.nextBytes(salt);

    PBEParameterSpec pbeParamSpec = new PBEParameterSpec(salt, count);
    PBEKeySpec pbeKeySpec = new PBEKeySpec(password.toCharArray());

    SecretKeyFactory keyFac = SecretKeyFactory.getInstance(MYPBEALG);
    SecretKey pbeKey = keyFac.generateSecret(pbeKeySpec);

    Cipher pbeCipher = Cipher.getInstance(MYPBEALG);
    // Initialize PBE Cipher with key and parameters
    pbeCipher.init(Cipher.ENCRYPT_MODE, pbeKey, pbeParamSpec);

    // Encrypt the encoded Private Key with the PBE key
    byte[] ciphertext = pbeCipher.doFinal(encodedprivkey);


    // Now construct  PKCS #8 EncryptedPrivateKeyInfo object
    AlgorithmParameters algparms = AlgorithmParameters.getInstance(MYPBEALG);
    algparms.init(pbeParamSpec);
    EncryptedPrivateKeyInfo encinfo = new EncryptedPrivateKeyInfo(algparms, ciphertext);

    FileOutputStream out3 = new FileOutputStream("server.key");
    out3.write(Base64.encodeBase64(encryptedPkcs8, true));
    out3.flush();
    out3.close();


    FileOutputStream out3 = new FileOutputStream("server.crt");
    out3.write(Base64.encodeBase64(chain[0].getEncoded(), true));
    out3.flush();
    out3.close();

I loaded the server certificate and key into data directory and when I started the server, its throwing me below error

    FATAL:  could not load private key file "server.key": unknown pbe algorithm

Please help me resolving this. Has anyone faced this error ? Any sort of help will be really appreciated.

Answer 1

According to the docs , passphrase encryption of server keys is possible but it means that PostgreSQL cannot be started without entering the key manually. This means, among other things that you cannot automatically restart the server process if it fails and you cannot automatically start postgreSQL on boot. If this is a part of your requirements please think about it very carefully and consider the tradeoff and what you have to do to address these problems.

The error message is telling you that the cypher used to passphrase-protect the server key is not supported. Choose a different cypher.