Horton

Re: [PATCH] Accept IP addresses in server certificate SANs

Daniel Gustafsson <daniel@yesql.se>

View thread View on postgr.es
From: Daniel Gustafsson <daniel@yesql.se>
To: Tom Lane <tgl@sss.pgh.pa.us>
Cc: Jacob Champion <pchampion@vmware.com>, "horikyota.ntt@gmail.com" <horikyota.ntt@gmail.com>, PostgreSQL Hackers <pgsql-hackers@postgresql.org>
Date: 2022-03-27T22:44:07Z
Lists: pgsql-hackers 
> On 27 Mar 2022, at 23:19, Tom Lane <tgl@sss.pgh.pa.us> wrote:

> This may be caused by 9ca234bae or 4a7e964fc.


I'd say 4a7e964fc is the culprit here.  From a quick skim the the
switch_server_cert() calls need to be changed along the lines of:

  from: switch_server_cert($node, 'server-ip-in-dnsname');
    to: switch_server_cert($node, certfile => 'server-ip-in-dnsname');

There migth be more changes required, that was the one that stood out.  Unless
someone beats me to it I'll take a look at fixing up the test in this patch
tomorrow.

--
Daniel Gustafsson		https://vmware.com/

Commits

  1. libpq: Allow IP address SANs in server certificates

  2. Add SSL tests for IP addresses in certificates

  3. Make JSON path numeric literals more correct