Horton

Re: Making sslrootcert=system work on Windows psql

George MacKerron <george@mackerron.co.uk>

View thread
From: George MacKerron <george@mackerron.co.uk>
To: Jelte Fennema-Nio <postgres@jeltef.nl>
Cc: Daniel Gustafsson <daniel@yesql.se>, Jacob Champion <jacob.champion@enterprisedb.com>, PostgreSQL Hackers <pgsql-hackers@postgresql.org>
Date: 2025-04-25T10:20:55Z
Lists: pgsql-hackers

Commits

Same data as JSON: GET /api/v1/messages/:b64id/commits the thread's linked commits as JSON, with link sources. API reference →

  1. doc: Clarify the system value for sslrootcert

> On Thu, 24 Apr 2025 at 23:52, Jelte Fennema-Nio <postgres@jeltef.nl> wrote:
> 
>> How about we add a *compile time*
>> option that allows the person that compiles libpq to choose which cert
>> store it should use if sslrootcert=system is provided. Something like
>> --system-cert-store=openssl and --system-cert-store=winstore flags for
>> ./configure.
> 
> @George So basically my suggestion is to make the behaviour that your
> patch introduces configurable at compile time. FWIW my vote would
> probably be to default to --system-cert-store=winstore if it's
> available. And then --system-cert-store=openssl would be a way out for
> people that took the effort to configure openssl correctly on Windows.

👍 I think that’s a pretty nice idea.

On the other hand, what are the specific objections to doing it dynamically, the way my patch does? I think that has backwards-compatibility quite well covered.

Is the main concern that users may be surprised that the behaviour of psql changes if they later set one of the OpenSSL environment variables or put cert files in OPENSSLDIR? I feel like that would be quite rare and also a pretty safe failure mode.