| From: | Peter Eisentraut <peter(dot)eisentraut(at)enterprisedb(dot)com> |
|---|---|
| To: | Jacob Champion <jchampion(at)timescale(dot)com>, Daniel Gustafsson <daniel(at)yesql(dot)se> |
| Cc: | "Gregory Stark (as CFM)" <stark(dot)cfm(at)gmail(dot)com>, PostgreSQL Hackers <pgsql-hackers(at)postgresql(dot)org>, Magnus Hagander <magnus(at)hagander(dot)net>, Michael Paquier <michael(at)paquier(dot)xyz>, thomas(at)habets(dot)se, Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us>, Bruce Momjian <bruce(at)momjian(dot)us>, Andrew Dunstan <andrew(at)dunslane(dot)net>, Jelte Fennema <postgres(at)jeltef(dot)nl> |
| Subject: | Re: [PATCH] Add `verify-system` sslmode to use system CA pool for server cert |
| Date: | 2023-04-12 21:23:11 |
| Message-ID: | c07769e5-7fc7-8e4d-cbd1-6baa55127b36@enterprisedb.com |
| Views: | Raw Message | Whole Thread | Download mbox | Resend email |
| Thread: | |
| Lists: | pgsql-hackers |
On 12.04.23 22:52, Jacob Champion wrote:
> It surprises me that you can get a successful test with a missing
> certs directory. If I remove the workaround in Cirrus, I get the
> following error, which looks the same to me:
>
> [20:40:00.253](0.000s) not ok 121 - sslrootcert=system does not
> connect with private CA: matches
> [20:40:00.253](0.000s) # Failed test 'sslrootcert=system does
> not connect with private CA: matches'
> # at /Users/admin/pgsql/src/test/ssl/t/001_ssltests.pl line 479.
> [20:40:00.253](0.000s) # 'psql: error:
> connection to server at "127.0.0.1", port 57681 failed: SSL SYSCALL
> error: Undefined error: 0'
> # doesn't match '(?^:SSL error: certificate verify failed)'
>
> (That broken error message has changed since 3.0; now it's busted in a
> new way as of 3.1, I guess.)
>
> Does the test start passing if you create an empty certs directory? It
> still wouldn't explain why Daniel's setup is succeeding...
After
mkdir /usr/local/etc/openssl(at)3/certs
the tests pass!
| From | Date | Subject | |
|---|---|---|---|
| Next Message | David Rowley | 2023-04-12 21:36:01 | Re: v12: ERROR: subplan "InitPlan 2 (returns $4)" was not initialized |
| Previous Message | Peter Eisentraut | 2023-04-12 21:19:23 | Re: Documentation for building with meson |