Re: [PATCH] Add `verify-system` sslmode to use system CA pool for server cert

From: Jacob Champion <jchampion(at)timescale(dot)com>
To: thomas(at)habets(dot)se
Cc: pgsql-hackers(at)postgresql(dot)org, Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us>, Bruce Momjian <bruce(at)momjian(dot)us>, Andrew Dunstan <andrew(at)dunslane(dot)net>
Subject: Re: [PATCH] Add `verify-system` sslmode to use system CA pool for server cert
Date: 2022-11-01 17:03:29
Message-ID: CAAWbhmiooyr5s9X_i9Zw5sO5Ba_GPJ9EvoAQvz7gabApZ6UKQg@mail.gmail.com
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-hackers

On Tue, Nov 1, 2022 at 5:30 AM <thomas(at)habets(dot)se> wrote:
> Sweet. I just created an account with username `habets`.

Added!

OpenSSL 3.0.0 doesn't get along with one of my new tests:

# Failed test 'sslrootcert=system does not connect with private CA: matches'
# at /Users/admin/pgsql/src/test/ssl/t/001_ssltests.pl line 453.
# 'psql: error: connection to server at "127.0.0.1", port 56124
failed: SSL error: unregistered scheme'
# doesn't match '(?^:SSL error: certificate verify failed)'
# Looks like you failed 1 test of 191.

I'm not familiar with "unregistered scheme" in this context and will
need to dig in.

--Jacob

In response to

Responses

Browse pgsql-hackers by date

  From Date Subject
Next Message Andres Freund 2022-11-01 17:41:23 Re: heavily contended lwlocks with long wait queues scale badly
Previous Message Magnus Hagander 2022-11-01 16:36:07 Re: Commit fest 2022-11