Re: sslinfo extension - add notbefore and notafter timestamps

Daniel Gustafsson <daniel@yesql.se>

From: Daniel Gustafsson <daniel@yesql.se>

To: Cary Huang <cary.huang@highgo.ca>

Cc: Pgsql Hackers <pgsql-hackers@postgresql.org>

Date: 2022-08-20T11:02:01Z

Lists: pgsql-hackers

Commits

Same data as JSON: GET /api/v1/messages/:b64id/commits the thread's linked commits as JSON, with link sources. API reference →

Add notBefore and notAfter to SSL cert info display
- 6acb0a628ecc 17.0 landed
- 75ec5e7bec70 17.0 landed
Set fixed dates for test certificates validity
- 40fad96530ca 17.0 landed

> On 20 Aug 2022, at 01:00, Cary Huang <cary.huang@highgo.ca> wrote:

> I noticed that sslinfo extension does not have functions to return current client certificate's notbefore and notafter timestamps which are also quite important attributes in a X509 certificate. The attached patch adds 2 functions to get notbefore and notafter timestamps from the currently connected client certificate.

Off the cuff that doesn't seem like a bad idea, but I wonder if we should add
them to pg_stat_ssl (or both) instead if we deem them valuable?

Re the patch, it would be nice to move the logic in ssl_client_get_notafter and
the _notbefore counterpart to a static function since they are copies of
eachother.

--
Daniel Gustafsson		https://vmware.com/