Content-Type: text/plain;
	charset=us-ascii
Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3696.120.41.1.1\))
Subject: Re: proper pg_hba config to require ssl from non-local/private ips
From: Scott Ribe <scott_ribe@elevated-dev.com>
In-Reply-To: 
 <CANpBAJv81XXimKZCnv-u2yBGw6LyTTW7Y6eyUBZUwcMKa=unZw@mail.gmail.com>
Date: Wed, 19 Oct 2022 10:41:41 -0600
Cc: pgsql-admin <pgsql-admin@lists.postgresql.org>
Content-Transfer-Encoding: quoted-printable
Message-Id: <E7513C58-F643-41B0-9EFD-EA8455B36553@elevated-dev.com>
References: 
 <CANpBAJtuxCRnqvixsMFK-D7G=T6T_ma-Xef62saLR8doCW+tRw@mail.gmail.com>
 <CAMkU=1zmeaZrLziKiYB62weDDMtQ1MpBb-6ja3M4=7D5HoSZmQ@mail.gmail.com>
 <CANpBAJv81XXimKZCnv-u2yBGw6LyTTW7Y6eyUBZUwcMKa=unZw@mail.gmail.com>
To: Matthew Lenz <mlenz@nocturnal.org>
Archived-At: 
 <https://www.postgresql.org/message-id/E7513C58-F643-41B0-9EFD-EA8455B36553%40elevated-dev.com>
Precedence: bulk

> On Oct 19, 2022, at 10:29 AM, Matthew Lenz <mlenz@nocturnal.org> =
wrote:
>=20
> I didn't say the client was meant to enforce it.  I meant the server =
should be enforcing it (it's not).

Doesn't really make sense for the server to determine client =
verification of server certificate.

1) Server controls what certificate is provided, thus has control over =
what CA is used.

2) What would it mean for server to turn OFF client verification? Server =
is allowed to say "here's my cert, doesn't matter that it's using a =
bogus CA, you take it regardless of your local settings"???=