Re: Serverside SNI support in libpq

Hi Daniel,

Thanks very much for fixing these SSL reload and cleanup issues. I also
ran into the SNI reload issue while reviewing the DH parameter patch
and wrote a patch to try to fix it. I then checked whether the same
problem had already been reported, which led me to this thread.

I've reviewed all five patches in v5. They look good to me, and I
didn't find any further problems. The attached patch adds tests on top
of v5 for a few cases missing from 004_sni.pl:

1. Enabling SNI by reloading with an encrypted per-host key and its own
passphrase command. The existing encrypted-key tests start with SNI
already enabled.

2. Turning SNI off while ssl_cert_file points to a missing file, with a
default host configured. The default and named hosts use different
certificates, so verify-full checks that the failed reload leaves
the named host's certificate in use.

3. Retrying the reload after restoring a valid global certificate and
key. The test checks that SNI host selection is disabled and a new
connection verifies the global certificate.

The added tests pass with v5.

Regards,
Rui