Skip site navigation (1) Skip section navigation (2)

Re: libpq 8.4 beta1: $PGHOST complains about missingroot.crt

From: Stephen Frost <sfrost(at)snowman(dot)net>
To: Peter Eisentraut <peter_e(at)gmx(dot)net>
Cc: pgsql-bugs(at)postgresql(dot)org, Martin Pitt <mpitt(at)debian(dot)org>
Subject: Re: libpq 8.4 beta1: $PGHOST complains about missingroot.crt
Date: 2009-04-10 18:32:29
Message-ID: 20090410183229.GG8123@tamriel.snowman.net (view raw or flat)
Thread:
Lists: pgsql-bugs
* Peter Eisentraut (peter_e(at)gmx(dot)net) wrote:
> This is not a question of new client with old server.  The new version of the 
> client has a more secure default that will possibly prevent it from connecting 
> to *any* server that is not adequately configured.

A properly configured server could cause a failure too unless the client
is *also* properly configured.  Sure, it's good for people to do.  No, I
don't think we should break things if people don't build out a whole PKI
for PG and configure all their certs correctly.  It's pie-in-the-sky to
think everyone will do that, and in the end most will just say "SSL
breaks stuff, so we'll disable it" which certainly isn't better.

> But it's a default, so the user can change it.

It should be the default to connect, maybe with a warning.

> Consider the analogy that a new web browser comes out that verifies server 
> certificates (as of course all respectable browsers do nowadays) whereas the 
> previous version one didn't.  The right fix there is certainly not to 
> downgrade this to a warning when connecting to an older web server.

Uh, no, the right fix is to have a warning/prompt (as pretty much all
web browsers today do) but then continue to connect.  Also, the
web-browser analogy completely falls apart when you consider that the
use case is significantly different (how many times have you connected
to a PG server that you didn't know?).

	Thanks,

		Stephen

In response to

Responses

pgsql-bugs by date

Next:From: Kevin GrittnerDate: 2009-04-10 18:40:06
Subject: Re: Re: [BUGS] BUG #4027: backslash escapingnotdisabled inplpgsql
Previous:From: Stephen FrostDate: 2009-04-10 18:27:54
Subject: Re: libpq 8.4 beta1: $PGHOST complains about missingroot.crt

Privacy Policy | About PostgreSQL
Copyright © 1996-2014 The PostgreSQL Global Development Group