From: Michael Paquier <michael@paquier.xyz>
To: pgsql-committers@lists.postgresql.org
Subject: pgsql: Use explicit fetching of digests in channel binding (OpenSSL >=
Date: Thu, 13 Aug 2026 22:37:22 +0000
Message-ID: <E1wue37-00000000T6J-20MC@gemulon.postgresql.org> (raw)
Use explicit fetching of digests in channel binding (OpenSSL >= 3.0)
This commit touches both the libpq and backend-side code of channel
binding where respectively pgtls_get_peer_certificate_hash() and
be_tls_get_certificate_hash() are upgraded to retrieve digests using the
method recommended by OpenSSL 3.0: no more direct EVP_sha256() or
similar, just a EVP_MD_fetch() through EVP to get an algorythm type,
based on a name.
The pre-3.0 code is still required for LibreSSL and as long as we
support OpenSSL 1.1.1.
Similar work has been done in b91f79cd08ab and 1f3b9bb109b8.
Author: Mark Atwood <mark@reviewcommit.com>
Co-authored-by: Michael Paquier <michael@paquier.xyz>
Discussion: https://postgr.es/m/178596055149.1584250.13974609482797470185@reviewcommit.com
Branch
------
master
Details
-------
https://git.postgresql.org/pg/commitdiff/28995f051e72a1efae0e85d0ea43f80c38166657
Modified Files
--------------
src/backend/libpq/be-secure-openssl.c | 34 ++++++++++++++++++++++++++++
src/interfaces/libpq/fe-secure-openssl.c | 38 ++++++++++++++++++++++++++++++++
2 files changed, 72 insertions(+)
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-committers@postgresql.org
Cc: michael@paquier.xyz, pgsql-committers@lists.postgresql.org
Subject: Re: pgsql: Use explicit fetching of digests in channel binding (OpenSSL >=
In-Reply-To: <E1wue37-00000000T6J-20MC@gemulon.postgresql.org>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox