Re: Changing client-side behavior regarding Certificate Revocation Lists (CRL)

> On 24 Aug 2026, at 17:34, Михаил Купцов <mr(dot)cuptsov2018(at)yandex(dot)ru> wrote:

> I would like to propose a different approach regarding the client side behavior
> in terms of working with the list of revoked certificates. The problem that
> was discovered is that if a user, using psql, accidentally specifies an
> incorrect path to a crl file or crl directory, the client part of Postgres
> ignores the user's error and connects the client to the database whose
> certificate the client would, in theory, want to check whether the database
> server certificate has been revoked.

I'm sympathetic to the idea of helping the user detect misconfiguration.
However, I wonder how common it is to have a "local default" filename
configured in apps which may or may not be present. If those users all of a
sudden cannot connect after an upgrade then we didn't really improve anything.

Also, with this patch, users who have placed their CRL to match the default CRL
file location (~/.postgresql/root.crl) won't get an error if that file is
missing even if their intention was to use that file.

I think a stricter CRL policy would need another trigger.

--
Daniel Gustafsson