Re: libpq 8.4 beta1: $PGHOST complains about missing root.crt

From: Hiroshi Inoue <inoue(at)tpf(dot)co(dot)jp>
To: Magnus Hagander <magnus(at)hagander(dot)net>
Cc: Bruce Momjian <bruce(at)momjian(dot)us>, Martin Pitt <mpitt(at)debian(dot)org>, pgsql-bugs(at)postgresql(dot)org
Subject: Re: libpq 8.4 beta1: $PGHOST complains about missing root.crt
Date: 2009-04-11 23:38:42
Message-ID: 49E12A02.7030009@tpf.co.jp
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-bugs

Magnus Hagander wrote:
> Bruce Momjian wrote:
>> Martin Pitt wrote:
>>> I do see the benefit of failing to connect to an SSL-enabled server
>>> *if* I have a root.crt which doesn't match. But why fail if I don't
>>> have one?
>> I have digested this thread, and have done two things: improved the
>> documentation and posted a patch to make the error message clearer.
>>
>> In terms of your suggestion about root.crt, I think sslverify != none
>> should error if it can't verify the server's certificate, whether the
>> root.crt file is there or not. If you are asking for sslverify, it
>> should do that or error, not ignore the setting if there is no root.crt
>> file. The only other approach would be to add an sslverify value of
>> 'try' that tries only if root.crt exists.
>
> Doesn't "try" make the whole check pretty pointless, and you can just
> set it to "none" then?

Yes the snapshot psqlodbc driver already set sslverify to none and can't
change it though it may be differnet from the expected behavior. It was
not so easy to implement because sslverify parameter is illegal for <=
8.3 libpq and the psqlodbc driver doesn't rely on environment variables
at all.

regards,
Hiroshi Inoue

In response to

Responses

Browse pgsql-bugs by date

  From Date Subject
Next Message Bruce Momjian 2009-04-12 01:25:39 Re: libpq 8.4 beta1: $PGHOST complains about missing root.crt
Previous Message Tom Lane 2009-04-11 23:15:23 Re: libpq 8.4 beta1: $PGHOST complains about missing root.crt