Re: Changing client-side behavior regarding Certificate Revocation Lists (CRL)

From: Jacob Champion <jacob(dot)champion(at)enterprisedb(dot)com>
To: Михаил Купцов <mr(dot)cuptsov2018(at)yandex(dot)ru>
Cc: Daniel Gustafsson <daniel(at)yesql(dot)se>, "pgsql-hackers(at)lists(dot)postgresql(dot)org" <pgsql-hackers(at)lists(dot)postgresql(dot)org>
Subject: Re: Changing client-side behavior regarding Certificate Revocation Lists (CRL)
Date: 2026-08-26 16:34:50
Message-ID: CAOYmi+n_4Mhk-ZJohWKWk3S5-fzDL_8yApEWQP9mJcKNBTbYCQ@mail.gmail.com
Views: Whole Thread | Raw Message | Download mbox | Resend email
Thread:
Lists: pgsql-hackers

On Wed, Aug 26, 2026 at 7:00 AM Михаил Купцов <mr(dot)cuptsov2018(at)yandex(dot)ru> wrote:
> But if we think about it within the current state of configuration:

(We can think about it that way, but I'm not sure it makes sense to
split the difference between the current unhelpful behavior and a new
behavior that must break compatibility in some form anyway. Maybe we
could just implement the desired behavior with a clean break instead;
that's why I mentioned libpqrc.)

> The idea of the patch is to ensure that the client-side performs stricter configuration checking for CRL files than it currently does.

Right, but since Daniel pointed out that this isn't a straight upgrade
in behavior, I don't think it necessarily gets the benefit of an
"incremental improvement" pass.

--Jacob

In response to

Browse pgsql-hackers by date

  From Date Subject
Next Message Palak Chaturvedi 2026-08-26 16:36:11 Re: Changing shared_buffers without restart
Previous Message Diego 2026-08-26 16:25:28 Re: [Proposal] add portaddr like hostaddr