Horton

Re: [PATCH] Add `verify-system` sslmode to use system CA pool for server cert

Jacob Champion <jchampion@timescale.com>

View thread View on postgr.es
From: Jacob Champion <jchampion@timescale.com>
To: thomas@habets.se
Cc: pgsql-hackers@postgresql.org, Tom Lane <tgl@sss.pgh.pa.us>, Bruce Momjian <bruce@momjian.us>, Andrew Dunstan <andrew@dunslane.net>
Date: 2022-11-01T17:03:29Z
Lists: pgsql-hackers 
On Tue, Nov 1, 2022 at 5:30 AM <thomas@habets.se> wrote:
> Sweet. I just created an account with username `habets`.

Added!

OpenSSL 3.0.0 doesn't get along with one of my new tests:

    # Failed test 'sslrootcert=system does not connect with private CA: matches'
    # at /Users/admin/pgsql/src/test/ssl/t/001_ssltests.pl line 453.
    # 'psql: error: connection to server at "127.0.0.1", port 56124
failed: SSL error: unregistered scheme'
    # doesn't match '(?^:SSL error: certificate verify failed)'
    # Looks like you failed 1 test of 191.

I'm not familiar with "unregistered scheme" in this context and will
need to dig in.

--Jacob

Commits

  1. ci: Remove OpenSSL 3.1 workaround for missing system CA

  2. Fix errormessage for missing system CA in OpenSSL 3.1

  3. Add MacPorts support to src/test/ldap tests.

  4. Allow to use system CA pool for certificate verification