From: Tom Lane <tgl@sss.pgh.pa.us>
To: Nikhil Shetty <nikhil.dba04@gmail.com>
Cc: Pgsql-admin <pgsql-admin@lists.postgresql.org>
Subject: Re: Question on SSL certificate expiry
Date: Thu, 01 Jun 2023 09:07:18 -0400
Message-ID: <3780.1685624838@sss.pgh.pa.us> (raw)
In-Reply-To: <CAFpL5Vwbf15c1isEreO1zSrEwkMXJ44kX4NywtpstzEav5p=Vg@mail.gmail.com>
References: <CAFpL5Vwbf15c1isEreO1zSrEwkMXJ44kX4NywtpstzEav5p=Vg@mail.gmail.com>
Nikhil Shetty <nikhil.dba04@gmail.com> writes:
> We were using MTLS to connect to the database. We noticed that even after
> server certificates expired the client was able to connect to the database.
> 1. Doesn't postgres check the expiry date of the certificate?
Postgres does not. The openssl library can. The most likely
guess, on the basis of the next-to-zero details you provided,
is that the connection is succeeding via some method that doesn't
require the client to check the server's certificate --- for
instance, a completely unencrypted connection.
regards, tom lane
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-admin@postgresql.org
Cc: tgl@sss.pgh.pa.us, nikhil.dba04@gmail.com, pgsql-admin@lists.postgresql.org
Subject: Re: Question on SSL certificate expiry
In-Reply-To: <3780.1685624838@sss.pgh.pa.us>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox