Skip site navigation (1) Skip section navigation (2)

Re: SSL cleanups/hostname verification

From: Magnus Hagander <magnus(at)hagander(dot)net>
To: Bruce Momjian <bruce(at)momjian(dot)us>
Cc: PG Hackers <pgsql-hackers(at)postgresql(dot)org>
Subject: Re: SSL cleanups/hostname verification
Date: 2008-10-23 20:58:36
Message-ID: 4900E57C.2060907@hagander.net (view raw or flat)
Thread:
Lists: pgsql-hackers
Bruce Momjian wrote:
> Magnus Hagander wrote:
>> Attached patch cleans up the certificate verification in libpq, and adds
>> a configuration paraqmeter to control it. The new parameter is
>> "sslverify", and can be set to:
> 
> Because SSL offers both encryption and authentication, I wonder if we
> should call this "sslauthenticate".

I think that would confuse people with actual SSL certificate based
authentication, which we do not (yet) have.


>> * cn = default = will validate that the certificate chains to a trusted
>> root, *and* that the cn on the certificate matches the hostname
>> specificed in the connection. This is the only option that prevents
>> man-in-the-middle attacks completely, and therefor is the default.
> 
> Should this be "commonname"?

"cn" is a fairly standard way to refer to it, but if people think the
longer name is better, I'm ok with changing it.


>> * cert = what we had before if there was a root certificate file = will
>> validate that the certificate chains to a trusted root, but ignore the cn.
> 
> Should this be "chain"?

Could be, not sure.


//Magnus


In response to

pgsql-hackers by date

Next:From: Magnus HaganderDate: 2008-10-23 21:23:21
Subject: SSL README
Previous:From: Greg SmithDate: 2008-10-23 20:53:24
Subject: Re: Multi CPU Queries - Feedback and/or suggestions wanted!

Privacy Policy | About PostgreSQL
Copyright © 1996-2014 The PostgreSQL Global Development Group