| From: | Jacob Champion <jchampion(at)timescale(dot)com> |
|---|---|
| To: | Jelte Fennema <postgres(at)jeltef(dot)nl> |
| Cc: | Michael Paquier <michael(at)paquier(dot)xyz>, thomas(at)habets(dot)se, pgsql-hackers(at)postgresql(dot)org, Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us>, Bruce Momjian <bruce(at)momjian(dot)us>, Andrew Dunstan <andrew(at)dunslane(dot)net> |
| Subject: | Re: [PATCH] Add `verify-system` sslmode to use system CA pool for server cert |
| Date: | 2023-01-10 23:15:47 |
| Message-ID: | CAAWbhmia+5zqZ-3ZmKzcAHH0JDRMQF2P-bKbgSpKRNiD9_fL2w@mail.gmail.com |
| Views: | Raw Message | Whole Thread | Download mbox | Resend email |
| Thread: | |
| Lists: | pgsql-hackers |
On Mon, Jan 9, 2023 at 7:07 AM Jelte Fennema <postgres(at)jeltef(dot)nl> wrote:
> I also took a closer look at the code, and the only comment I have is:
>
> > appendPQExpBuffer(&conn->errorMessage,
>
> These calls can all be replaced by the recently added libpq_append_conn_error
Argh, thanks for the catch. Fixed.
> Finally I tested this against a Postgres server I created on Azure and
> the new value works as expected. The only thing that I think would be
> good to change is the error message when sslmode=verify-full, and
> sslrootcert is not provided, but ~/.postgresql/root.crt is also not available.
> I think it would be good for the error to mention sslrootcert=system
Good idea. The wording I chose in v6 is
Either provide the file, use the system's trusted roots with
sslrootcert=system, or change sslmode to disable server certificate
verification.
What do you think?
Thanks!
--Jacob
| Attachment | Content-Type | Size |
|---|---|---|
| since-v5.diff.txt | text/plain | 2.8 KB |
| v6-0001-libpq-add-sslrootcert-system-to-use-default-CAs.patch | text/x-patch | 23.2 KB |
| v6-0002-libpq-force-sslmode-verify-full-for-system-CAs.patch | text/x-patch | 8.7 KB |
| From | Date | Subject | |
|---|---|---|---|
| Next Message | Justin Pryzby | 2023-01-10 23:26:34 | wal_compression = method:level |
| Previous Message | Tom Lane | 2023-01-10 22:13:06 | Re: ATTACH PARTITION seems to ignore column generation status |