docs: clarify intermediate certificate creation instructions

Specifically, explain the v3_ca openssl specification.

Discussion: https://postgr.es/m/20200824175653[email protected]

Backpatch-through: 9.5

diff --git a/doc/src/sgml/runtime.sgml b/doc/src/sgml/runtime.sgml
index c8698898f3256eb5dc5c5113ff30c4c7f2b037e0..a01add94b7fd8a9f4d11b702042ce3ba17f0ccf2 100644 (file)
--- a/doc/src/sgml/runtime.sgml
+++ b/doc/src/sgml/runtime.sgml
@@ -2193,8 +2193,10 @@ pg_dumpall -p 5432 | psql -d postgres -p 5433
    The certificates of intermediate certificate authorities
    can also be appended to the file.  Doing this avoids the necessity of
    storing intermediate certificates on clients, assuming the root and
-   intermediate certificates were created with v3_ca
-   extensions.  This allows easier expiration of intermediate certificates.
+   intermediate certificates were created with v3_ca 
+   extensions.  (This sets the certificate's basic constraint of
+   CA to true.)
+   This allows easier expiration of intermediate certificates.