Horton

[PATCH] Add `verify-system` sslmode to use system CA pool for server cert

thomas@habets.se

View thread View on postgr.es
From: Thomas Habets <thomas@habets.se>
To: pgsql-hackers@postgresql.org
Date: 2021-09-06T15:42:07Z
Lists: pgsql-hackers

Attachments

With Letsencrypt now protecting web servers left and right, and it makes
sense to me to just re-use the cert that the server may already have
installed.

I've tested this on debian with the client compiled from the master branch,
against a 13.3 server.

This is my first patch to postgresql, so I apologize for any process
errors. I tried to follow
https://wiki.postgresql.org/wiki/Submitting_a_Patch

Hope this list takes attachments.

-- 
typedef struct me_s {
 char name[]      = { "Thomas Habets" };
 char email[]     = { "thomas@habets.se <thomas@habets.pp.se>" };
 char kernel[]    = { "Linux" };
 char *pgpKey[]   = { "http://www.habets.pp.se/pubkey.txt" };
 char pgp[] = { "9907 8698 8A24 F52F 1C2E  87F6 39A4 9EEA 460A 0169" };
 char coolcmd[]   = { "echo '. ./_&. ./_'>_;. ./_" };
} me_t;

Commits

  1. ci: Remove OpenSSL 3.1 workaround for missing system CA

  2. Fix errormessage for missing system CA in OpenSSL 3.1

  3. Add MacPorts support to src/test/ldap tests.

  4. Allow to use system CA pool for certificate verification