Re: BUG #4340: SECURITY: Is SSL Doing Anything?

Tom Lane wrote:
> "Dan Kaminsky" <dan(at)doxpara(dot)com> writes:
>
>> Clearly, this is handling self-signed certs. Great. But what I really want
>> to know is, is verify_peer accepting a self-signed identity assertion?
>> Because that'd be remote EoP.
>>
>
> I'm just guessing what you're driving at (unexplained acronyms aren't
> a good way to communicate), but I think it's not a big problem. PG
> doesn't rely on SSL for authentication, only for communications
> security, so whether the remote cert is self-signed doesn't seem
> like much of an issue. Anyway, you can adjust your list of trusted
> CAs to determine whether you'll accept it or not.
>
> regards, tom lane
>
Heh Tom,

Thanks for replying so quickly. It's definitely appreciated.

Apologies, EoP = Escalation of Privilege. I've been up all night.

Lets talk about the verify_cb callback first: Suppose there's a
man-in-the-middle between the PG client and the PG server. Is some
secondary force going to apply some Trusted CA list?

Second, are you saying verify_peer doesn't do anything for
authentication? Are you sure about that? There's really little reason
otherwise for the call to exist.

--Dan