Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.96) (envelope-from ) id 1wCCb3-001l2B-0q for pgsql-docs@arkaria.postgresql.org; Mon, 13 Apr 2026 08:24:42 +0000 Received: from localhost ([127.0.0.1] helo=malur.postgresql.org) by malur.postgresql.org with esmtp (Exim 4.96) (envelope-from ) id 1wCCb1-005aSb-22 for pgsql-docs@arkaria.postgresql.org; Mon, 13 Apr 2026 08:24:40 +0000 Received: from makus.postgresql.org ([2001:4800:3e1:1::229]) by malur.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.96) (envelope-from ) id 1wCCb1-005aSS-0D for pgsql-docs@lists.postgresql.org; Mon, 13 Apr 2026 08:24:40 +0000 Received: from smtp.outgoing.loopia.se ([93.188.3.37]) by makus.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.98.2) (envelope-from ) id 1wCCay-00000000lYQ-2lHZ for pgsql-docs@lists.postgresql.org; Mon, 13 Apr 2026 08:24:39 +0000 Received: from s807.loopia.se (localhost [127.0.0.1]) by s807.loopia.se (Postfix) with ESMTP id 32AA357FF04 for ; Mon, 13 Apr 2026 10:24:33 +0200 (CEST) Received: from s899.loopia.se (unknown [172.22.191.6]) by s807.loopia.se (Postfix) with ESMTP id 1DFA357FE0A; Mon, 13 Apr 2026 10:24:33 +0200 (CEST) Received: from localhost (unknown [172.22.191.6]) by s899.loopia.se (Postfix) with ESMTP id 1870D2C8BA29; Mon, 13 Apr 2026 10:24:33 +0200 (CEST) X-Virus-Scanned: amavis at amavis.loopia.se X-Spam-Flag: NO X-Spam-Score: -1.2 X-Spam-Level: X-Spam-Status: No, score=-1.2 tagged_above=-999 required=6.2 tests=[ALL_TRUSTED=-1, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1] autolearn=disabled Authentication-Results: s472.loopia.se (amavis); dkim=pass (2048-bit key) header.d=yesql.se Received: from s981.loopia.se ([172.22.191.6]) by localhost (s472.loopia.se [172.22.190.12]) (amavis, port 10024) with LMTP id sVoHrl7F9xcV; Mon, 13 Apr 2026 10:24:32 +0200 (CEST) X-Loopia-Auth: user X-Loopia-User: daniel@yesql.se X-Loopia-Originating-IP: 89.255.232.236 Received: from smtpclient.apple (customer-89-255-232-236.stosn.net [89.255.232.236]) (Authenticated sender: daniel@yesql.se) by s981.loopia.se (Postfix) with ESMTPSA id 6D3E722B16B6; Mon, 13 Apr 2026 10:24:32 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yesql.se; s=loopiadkim1707475645; t=1776068672; bh=BB6HqSGExDbNh6TmK8ddFXPJGyHj+HLSxZkNlp0KGVs=; h=From:Subject:Date:In-Reply-To:Cc:To:References; b=FJM6mrXH+GHAMu7dIW1f583T1XPUTolwNk98Vl+UFmsfHlalqHrCdKCrF6Ua0ZR0j ud5dk7GhifvvAGiA8/9BwCByC271iuKtGa0+TL+M/L91RAsQg8+j+TBaaf1huCmFr1 0vhHH077B1/41TATNvVbKpJjYlf71WfE3/IXgX0O7eu5kbYkA9npGOBbnbxCqRxIhW D5RUU07W9oL8gOdWe6OlYMSE50w7kXjFV26XxVUn3FubLd/mu9HDfqMOilKP4exdsv C6WzIGewiDIQkfgmAF7YBvOxWKec3/pfAQu6uWl9zfE36mOjoU8amdcuuU8fcsZGbX MKUxQE8xmJ92Q== From: Daniel Gustafsson Message-Id: <66E96B37-F331-44D3-AC9D-A183542615B4@yesql.se> Content-Type: multipart/mixed; boundary="Apple-Mail=_AFFCF216-235D-43E0-A00F-DC79124AE4E1" Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3776.700.51.11.2\)) Subject: Re: pgsql: ssl: Serverside SNI support for libpq Date: Mon, 13 Apr 2026 10:24:21 +0200 In-Reply-To: <307D3C0D-4628-4216-BD51-B4F7FBAE50FC@yesql.se> Cc: pgsql-docs@lists.postgresql.org To: Fujii Masao References: <307D3C0D-4628-4216-BD51-B4F7FBAE50FC@yesql.se> X-Mailer: Apple Mail (2.3776.700.51.11.2) List-Id: List-Help: List-Subscribe: List-Post: List-Owner: List-Archive: Archived-At: Precedence: bulk --Apple-Mail=_AFFCF216-235D-43E0-A00F-DC79124AE4E1 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 > On 10 Apr 2026, at 20:23, Daniel Gustafsson wrote: >=20 >> On 10 Apr 2026, at 18:34, Fujii Masao wrote: >>=20 >> On Wed, Mar 18, 2026 at 8:48=E2=80=AFPM Daniel Gustafsson >> wrote: >>>=20 >>> ssl: Serverside SNI support for libpq >>=20 >> This commit introduced the hosts_file and ssl_sni GUCs and added them = to >> postgresql.conf.sample, but I don't see any descriptions for them >> in config.sgml. Was that just an oversight? >=20 > That was a mistake when adding the doc portions of the patch. Thanks = for the > report, I'll work on a patch. Attached is what I have planned for this, it adds the GUCs as well as = tidies up the existing SSL SNI docs a bit. -- Daniel Gustafsson --Apple-Mail=_AFFCF216-235D-43E0-A00F-DC79124AE4E1 Content-Disposition: attachment; filename=v1-0001-doc-Add-missing-GUCs-to-SSL-SNI-docs.patch Content-Type: application/octet-stream; x-unix-mode=0644; name="v1-0001-doc-Add-missing-GUCs-to-SSL-SNI-docs.patch" Content-Transfer-Encoding: quoted-printable =46rom=201d70bf610bfe53b12c6f616261605fd23c4753fc=20Mon=20Sep=2017=20= 00:00:00=202001=0AFrom:=20Daniel=20Gustafsson=20= =0ADate:=20Mon,=2013=20Apr=202026=2010:08:49=20= +0200=0ASubject:=20[PATCH=20v1]=20doc:=20Add=20missing=20GUCs=20to=20SSL=20= SNI=20docs=0A=0AThe=20ssl_sni=20and=20hosts_file=20GUCs=20were=20missing=20= from=20the=20configuration=0Asection=20of=20the=20documentation,=20they=20= were=20only=20described=20in=20the=20main=0ASSL=20SNI=20subsection.=20=20= This=20adds=20the=20GUCs=20to=20the=20relevant=20sections=20as=0Awell=20= as=20rewords=20the=20existing=20SSL=20SNI=20documentation=20to=20refer=20= to=20the=0Asettings=20along=20with=20a=20few=20smaller=20fixups.=0A=0A= Author:=20Daniel=20Gustafsson=20=0AReported-by:=20Fujii=20= Masao=20=0ADiscussion:=20= https://postgr.es/m/CAHGQGwESD2Pty+J1kP3mXmWwMKZ5uJmknZdJsSGrMSRR6CQBmw@ma= il.gmail.com=0A---=0A=20doc/src/sgml/config.sgml=20=20|=2045=20= +++++++++++++++++++++++++++++++++++----=0A=20doc/src/sgml/runtime.sgml=20= |=2029=20++++++++++++-------------=0A=202=20files=20changed,=2055=20= insertions(+),=2019=20deletions(-)=0A=0Adiff=20--git=20= a/doc/src/sgml/config.sgml=20b/doc/src/sgml/config.sgml=0Aindex=20= 009295f20e9..67da9a1de66=20100644=0A---=20a/doc/src/sgml/config.sgml=0A= +++=20b/doc/src/sgml/config.sgml=0A@@=20-507,9=20+507,10=20@@=20= include_dir=20'conf.d'=0A=20=20=20=20=20=20=0A=20=20=20=20=20=20=20= In=20addition=20to=20the=20postgresql.conf=20file=0A= =20=20=20=20=20=20=20already=20mentioned,=20= PostgreSQL=20uses=0A-=20=20=20=20=20=20two=20= other=20manually-edited=20configuration=20files,=20which=20control=0A+=20= =20=20=20=20=20three=20other=20manually-edited=20configuration=20files,=20= which=20control=0A=20=20=20=20=20=20=20client=20authentication=20(their=20= use=20is=20discussed=20in=20).=20=20By=20default,=20all=20three=0A= +=20=20=20=20=20=20linkend=3D"client-authentication"/>)=20and=20SSL=20= host=20configuration.=0A+=20=20=20=20=20=20By=20default,=20all=20four=0A=20= =20=20=20=20=20=20configuration=20files=20are=20stored=20in=20the=20= database=20cluster's=20data=0A=20=20=20=20=20=20=20directory.=20=20The=20= parameters=20described=20in=20this=20section=20allow=20the=0A=20=20=20=20= =20=20=20configuration=20files=20to=20be=20placed=20elsewhere.=20=20= (Doing=20so=20can=20ease=0A@@=20-579,6=20+580,22=20@@=20include_dir=20= 'conf.d'=0A=20=20=20=20=20=20=20=0A=20=20=20=20=20=20= =0A=20=0A+=20=20=20=20=20=0A+=20=20=20=20=20=20= hosts_file=20(string)=0A+=20=20=20=20= =20=20=0A+=20=20=20=20=20=20=20= hosts_file=20configuration=20= parameter=0A+=20=20=20=20=20=20=0A+=20=20=20=20=20=20= =0A+=20=20=20=20=20=20=0A+=20=20=20=20=20=20=20=0A= +=20=20=20=20=20=20=20=20=20Specifies=20the=20configuration=20file=20for=20= host-based=20SSL=20configuration=0A+=20=20=20=20=20=20=20=20=20= (customarily=20called=20pg_hosts.conf).=0A+=20=20=20= =20=20=20=20=20=20This=20parameter=20can=20only=20be=20set=20at=20server=20= start.=20See=20also=0A+=20=20=20=20=20=20=20=20=20.=0A+=20=20=20=20=20=20=20=0A+=20=20=20=20=20= =20=0A+=20=20=20=20=20=0A+=0A=20=20=20=20=20=20= =0A=20=20=20=20=20=20=20= external_pid_file=20(string)=0A=20=20= =20=20=20=20=20=0A@@=20-620,10=20+637,11=20@@=20include_dir=20= 'conf.d'=0A=20=20=20=20=20=20=0A=20=20=20=20=20=20=20If=20you=20= wish,=20you=20can=20specify=20the=20configuration=20file=20names=20and=20= locations=0A=20=20=20=20=20=20=20individually=20using=20the=20parameters=20= config_file,=0A-=20=20=20=20=20=20= hba_file=20and/or=20ident_file.=0A= +=20=20=20=20=20=20hba_file,=20= ident_file=20and/or=0A+=20=20=20=20=20=20= hosts_file.=0A=20=20=20=20=20=20=20= config_file=20can=20only=20be=20specified=20on=20the=0A= =20=20=20=20=20=20=20postgres=20command=20line,=20but=20= the=20others=20can=20be=0A-=20=20=20=20=20=20set=20within=20the=20main=20= configuration=20file.=20=20If=20all=20three=20parameters=20plus=0A+=20=20= =20=20=20=20set=20within=20the=20main=20configuration=20file.=20=20If=20= all=20four=20parameters=20plus=0A=20=20=20=20=20=20=20= data_directory=20are=20explicitly=20set,=20then=20it=20= is=20not=20necessary=0A=20=20=20=20=20=20=20to=20specify=20= =20or=20PGDATA.=0A=20=20=20=20=20=20= =0A@@=20-1734,6=20+1752,25=20@@=20include_dir=20'conf.d'=0A=20=20=20= =20=20=20=20=20=0A=20=20=20=20=20=20=20=0A=20=20=20=20=20= =20=0A+=0A+=20=20=20=20=20=0A+=20=20=20=20=20=20= ssl_sni=20(boolean)=0A+=20=20=20=20= =20=20=0A+=20=20=20=20=20=20=20= ssl_sni=20configuration=20= parameter=0A+=20=20=20=20=20=20=0A+=20=20=20=20=20=20= =0A+=20=20=20=20=20=20=0A+=20=20=20=20=20=20=20=0A= +=20=20=20=20=20=20=20=20Enables=20SNI=20configuration=20for=20SSL=20= connections.=20=20When=20set=20to=20on=0A+=20=20=20=20= =20=20=20=20host=20configuration=20from=20=20is=20used,=20see=0A+=20=20=20=20=20=20=20=20= =20for=20more=20details.=0A+=20=20=20=20=20=20= =20=0A+=20=20=20=20=20=20=20=0A+=20=20=20=20=20=20=20=20= This=20parameter=20can=20only=20be=20set=20in=20the=20= postgresql.conf=0A+=20=20=20=20=20=20=20=20file=20= or=20on=20the=20server=20command=20line.=20=20The=20default=20is=20= off.=0A+=20=20=20=20=20=20=20=0A+=20=20=20=20=20= =20=0A+=20=20=20=20=20=0A=20=20=20=20=20= =0A=20=20=20=20=20=0A=20=20=20=20=0Adiff=20= --git=20a/doc/src/sgml/runtime.sgml=20b/doc/src/sgml/runtime.sgml=0A= index=208576ae325d4..b01e74638c4=20100644=0A---=20= a/doc/src/sgml/runtime.sgml=0A+++=20b/doc/src/sgml/runtime.sgml=0A@@=20= -2602,18=20+2602,16=20@@=20openssl=20x509=20-req=20-in=20server.csr=20= -text=20-days=20365=20\=0A=20=0A=20=20=20=20=0A=20=20=20=20=20= PostgreSQL=20can=20be=20configured=20for=20= Server=20Name=0A-=20=20=20=20Indication,=20SNI,=20= using=20the=20pg_hosts.conf=0A-=20=20=20=20= configuration=20file.=20PostgreSQL=20inspects=20= the=20TLS=0A-=20=20=20=20hostname=20extension=20in=20the=20SSL=20= connection=20handshake,=20and=20selects=20the=20right=0A-=20=20=20=20TLS=20= certificate,=20key=20and=20CA=20certificate=20to=20use=20for=20the=20= connection=20based=20on=0A-=20=20=20=20entries=20in=20the=20= configuration=20file=20pg_hosts.conf.=0A+=20=20=20=20= Indication,=20SNI,=20using=20the=20=0A+=20=20=20=20configuration=20parameter.=20= PostgreSQL=20inspects=20the=0A+=20=20=20=20= TLS=20hostname=20extension=20in=20the=20SSL=20connection=20handshake,=20= and=20selects=20the=0A+=20=20=20=20right=20certificate,=20key=20and=20CA=20= certificate=20to=20use=20for=20the=20connection=20based=0A+=20=20=20=20= on=20entries=20in=20the=20=20= configuration=20file.=0A=20=20=20=20=0A=20=0A=20=20=20=20=0A= -=20=20=20=20SNI=20configuration=20is=20defined=20in=20the=20hosts=20= configuration=20file,=0A-=20=20=20=20pg_hosts.conf,=20= which=20is=20stored=20in=20the=20cluster's=0A-=20=20=20=20data=20= directory.=20=20The=20hosts=20configuration=20file=20contains=20lines=20= of=20these=0A-=20=20=20=20general=20forms:=0A+=20=20=20=20The=20=20configuration=20file=20contains=20lines=20= of=0A+=20=20=20=20these=20general=20forms:=0A=20=0A=20= hostname=20= SSL_certificate=20= SSL_key=20=20= SSL_CA_certificate=20=20= SSL_passphrase_cmd=20=20= SSL_passphrase_cmd_reload=20=20= =20=0A=20include=20= file=0A@@=20-2622,8=20+2620,9=20@@=20openssl=20= x509=20-req=20-in=20server.csr=20-text=20-days=20365=20\=0A=20= =0A=20=20=20=20=20Comments,=20whitespace,=20line=20= continuations,=20and=20inclusion=20directives=20are=0A=20=20=20=20=20= handled=20in=20the=20same=20way=20as=0A-=20=20=20=20in=20= pg_hba.conf.=20=20= hostname=0A-=20=20=20=20is=20matched=20= against=20the=20hostname=20TLS=20extension=20in=20the=20SSL=20handshake.=0A= +=20=20=20=20in=20.=20=20= hostname=0A+=20=20=20=20is=20matched=20= case-insensitively=20against=20the=20hostname=20TLS=0A= +=20=20=20=20extension=20in=20the=20SSL=20handshake.=0A=20=20=20=20=20= SSL_certificate,=0A=20=20=20=20=20= SSL_key,=0A=20=20=20=20=20= SSL_CA_certificate,=0A@@=20-2655,7=20+2654,7=20= @@=20openssl=20x509=20-req=20-in=20server.csr=20-text=20-days=20365=20\=0A= =20=20=20=20=20=20=20=0A=20=20=20=20=20=20=20=20=0A=20=20=20=20= =20=20=20=20=20Host=20Entry=0A-=20=20=20=20=20=20=20=20= sslsni=0A+=20=20=20=20=20=20=20=20Hostname=20= extension=0A=20=20=20=20=20=20=20=20=20= Description=0A=20=20=20=20=20=20=20=20=0A=20=20=20=20= =20=20=20=0A@@=20-2695,9=20+2694,9=20@@=20openssl=20x509=20-req=20= -in=20server.csr=20-text=20-days=20365=20\=0A=20=20=20=20=0A=20=0A= =20=20=20=20=0A-=20=20=20=20If=20= pg_hosts.conf=20is=20empty=20or=20missing,=20then=20= the=20SSL=0A+=20=20=20=20If=20=20is=20= empty=20or=20missing,=20then=20the=20SSL=0A=20=20=20=20=20configuration=20= in=20postgresql.conf=20will=20be=20used=20for=20all=0A= -=20=20=20=20connections.=20If=20pg_hosts.conf=20is=20= non-empty=20then=20it=0A+=20=20=20=20connections.=20If=20=20is=20non-empty=20then=20it=0A=20=20=20=20=20= will=20take=20precedence=20over=20certificate=20and=20key=20settings=20= in=0A=20=20=20=20=20postgresql.conf.=0A=20=20=20=20= =0A@@=20-2705,7=20+2704,7=20@@=20openssl=20x509=20-req=20-in=20= server.csr=20-text=20-days=20365=20\=0A=20=20=20=20=0A=20=20=20=20=20= It=20is=20currently=20not=20possible=20to=20set=20different=20= clientname=0A=20=20=20=20=20values=20for=20the=20= different=20certificates.=20=20Any=20clientname=0A-=20= =20=20=20setting=20in=20pg_hba.conf=20will=20be=20= applied=20during=0A+=20=20=20=20setting=20in=20=20will=20be=20applied=20during=0A=20=20=20=20=20= authentication=20regardless=20of=20which=20set=20of=20certificates=20= have=20been=20loaded=0A=20=20=20=20=20via=20an=20SNI=20enabled=20= connection.=0A=20=20=20=20=0A--=20=0A2.39.3=20(Apple=20Git-146)=0A= =0A= --Apple-Mail=_AFFCF216-235D-43E0-A00F-DC79124AE4E1--