Skip site navigation (1) Skip section navigation (2)

Re: doc patch for ssl in server

From: Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us>
To: dom(at)happygiraffe(dot)net (Dominic Mitchell)
Cc: pgsql-patches(at)postgresql(dot)org, pgsql-hackers(at)postgresql(dot)org
Subject: Re: doc patch for ssl in server
Date: 2004-09-23 21:26:28
Message-ID: 12154.1095974788@sss.pgh.pa.us (view raw or flat)
Thread:
Lists: pgsql-hackerspgsql-patches
dom(at)happygiraffe(dot)net (Dominic Mitchell) writes:
> On Thu, Sep 23, 2004 at 04:37:52PM -0400, Tom Lane wrote:
>> That last statement is not actually correct, is it?  AFAICS we do tell
>> SSL to enforce certificates if we find a valid root.crt file.

> According to the docs[1], you also need
> SSL_VERIFY_FAIL_IF_NO_PEER_CERT if you want requests that do not send a
> certificate to be rejected.  That terminates the connection immediately.
> [1] http://www.openssl.org/docs/ssl/SSL_CTX_set_verify.html

Hmm.  Reading the SSL man page more closely, you're right.  This is a bug
IMHO --- the intention was that presence of a root.crt file would force
verification.  What we wanted to do was to allow servers to operate
without a root.crt file if they didn't care about verifying client
certificates.

It looks like the original coder simply got this backwards: the backend
code doesn't set SSL_VERIFY_FAIL_IF_NO_PEER_CERT, but the frontend code
does, which is silly because the flag is ignored on the client side.

Does anyone see a reason not to turn on SSL_VERIFY_FAIL_IF_NO_PEER_CERT
on the backend side?

			regards, tom lane

In response to

pgsql-hackers by date

Next:From: Tom LaneDate: 2004-09-23 21:37:04
Subject: Re: SQL-Invoked Procedures for 8.1
Previous:From: Tom LaneDate: 2004-09-23 21:12:56
Subject: Re: SQL-Invoked Procedures for 8.1

pgsql-patches by date

Next:From: Tom LaneDate: 2004-09-23 23:26:19
Subject: Re: ALTER TABLE .. OWNER TO and sequences
Previous:From: Dominic MitchellDate: 2004-09-23 21:11:58
Subject: Re: doc patch for ssl in server

Privacy Policy | About PostgreSQL
Copyright © 1996-2014 The PostgreSQL Global Development Group