public inbox for [email protected]
help / color / mirror / Atom feedpgsql: ssl: Serverside SNI support for libpq
6+ messages / 3 participants
[nested] [flat]
* pgsql: ssl: Serverside SNI support for libpq
@ 2026-03-18 11:48 Daniel Gustafsson <[email protected]>
2026-04-10 15:34 ` Re: pgsql: ssl: Serverside SNI support for libpq Fujii Masao <[email protected]>
0 siblings, 1 reply; 6+ messages in thread
From: Daniel Gustafsson @ 2026-03-18 11:48 UTC (permalink / raw)
To: [email protected]
ssl: Serverside SNI support for libpq
Support for SNI was added to clientside libpq in 5c55dc8b4733 with the
sslsni parameter, but there was no support for utilizing it serverside.
This adds support for serverside SNI such that certificate/key handling
is available per host. A new config file, $datadir/pg_hosts.conf, is
used for configuring which certificate and key should be used for which
hostname. In order to use SNI the ssl_sni GUC must be set to on, when
it is off the ssl configuration works just like before. If ssl_sni is
enabled and pg_hosts.conf is non-empty it will take precedence over
the regular SSL GUCs, if it is empty or missing the regular GUCs will
be used just as before this commit with no hostname specific handling.
The TLS init hook is not compatible with ssl_sni since it operates on
a single TLS configuration and SNI break that assumption. If the init
hook and ssl_sni are both enabled, a WARNING will be issued.
Host configuration can either be for a literal hostname to match, non-
SNI connections using the no_sni keyword or a default fallback matching
all connections. By omitting no_sni and the fallback a strict mode
can be achieved where only connections using sslsni=1 and a specified
hostname are allowed.
CRL file(s) are applied from postgresql.conf to all configured hostnames.
Serverside SNI requires OpenSSL, currently LibreSSL does not support
the required infrastructure to update the SSL context during the TLS
handshake.
Author: Daniel Gustafsson <[email protected]>
Co-authored-by: Jacob Champion <[email protected]>
Reviewed-by: Jacob Champion <[email protected]>
Reviewed-by: Zsolt Parragi <[email protected]>
Reviewed-by: Chao Li <[email protected]>
Reviewed-by: Dewei Dai <[email protected]>
Reviewed-by: Cary Huang <[email protected]>
Reviewed-by: Heikki Linnakangas <[email protected]>
Discussion: https://postgr.es/m/[email protected]
Branch
------
master
Details
-------
https://git.postgresql.org/pg/commitdiff/4f433025f666fa4a6209f0e847715767fb1c7ace
Modified Files
--------------
configure | 2 +-
configure.ac | 2 +-
doc/src/sgml/runtime.sgml | 123 +++
meson.build | 1 +
src/backend/Makefile | 2 +
src/backend/commands/variable.c | 21 +
src/backend/libpq/be-secure-common.c | 267 ++++++-
src/backend/libpq/be-secure-openssl.c | 863 ++++++++++++++++++---
src/backend/libpq/be-secure.c | 3 +
src/backend/libpq/meson.build | 1 +
src/backend/libpq/pg_hosts.conf.sample | 4 +
src/backend/utils/misc/guc.c | 32 +
src/backend/utils/misc/guc_parameters.dat | 15 +
src/backend/utils/misc/guc_tables.c | 1 +
src/backend/utils/misc/postgresql.conf.sample | 3 +
src/bin/initdb/initdb.c | 15 +-
src/include/libpq/hba.h | 30 +
src/include/libpq/libpq.h | 5 +-
src/include/pg_config.h.in | 3 +
src/include/utils/guc.h | 1 +
src/include/utils/guc_hooks.h | 1 +
.../ssl_passphrase_callback/t/001_testfunc.pl | 34 +
src/test/perl/PostgreSQL/Test/Cluster.pm | 35 +
src/test/ssl/meson.build | 1 +
src/test/ssl/t/001_ssltests.pl | 6 +-
src/test/ssl/t/004_sni.pl | 453 +++++++++++
src/tools/pgindent/typedefs.list | 2 +
27 files changed, 1828 insertions(+), 98 deletions(-)
^ permalink raw reply [nested|flat] 6+ messages in thread
* Re: pgsql: ssl: Serverside SNI support for libpq
2026-03-18 11:48 pgsql: ssl: Serverside SNI support for libpq Daniel Gustafsson <[email protected]>
@ 2026-04-10 15:34 ` Fujii Masao <[email protected]>
2026-04-10 18:23 ` Re: pgsql: ssl: Serverside SNI support for libpq Daniel Gustafsson <[email protected]>
0 siblings, 1 reply; 6+ messages in thread
From: Fujii Masao @ 2026-04-10 15:34 UTC (permalink / raw)
To: Daniel Gustafsson <[email protected]>; +Cc: [email protected]
On Wed, Mar 18, 2026 at 8:48 PM Daniel Gustafsson
<[email protected]> wrote:
>
> ssl: Serverside SNI support for libpq
This commit introduced the hosts_file and ssl_sni GUCs and added them to
postgresql.conf.sample, but I don't see any descriptions for them
in config.sgml. Was that just an oversight?
Regards,
--
Fujii Masao
^ permalink raw reply [nested|flat] 6+ messages in thread
* Re: pgsql: ssl: Serverside SNI support for libpq
2026-03-18 11:48 pgsql: ssl: Serverside SNI support for libpq Daniel Gustafsson <[email protected]>
2026-04-10 15:34 ` Re: pgsql: ssl: Serverside SNI support for libpq Fujii Masao <[email protected]>
@ 2026-04-10 18:23 ` Daniel Gustafsson <[email protected]>
2026-04-13 08:24 ` Re: pgsql: ssl: Serverside SNI support for libpq Daniel Gustafsson <[email protected]>
0 siblings, 1 reply; 6+ messages in thread
From: Daniel Gustafsson @ 2026-04-10 18:23 UTC (permalink / raw)
To: Fujii Masao <[email protected]>; +Cc: [email protected]
> On 10 Apr 2026, at 18:34, Fujii Masao <[email protected]> wrote:
>
> On Wed, Mar 18, 2026 at 8:48 PM Daniel Gustafsson
> <[email protected]> wrote:
>>
>> ssl: Serverside SNI support for libpq
>
> This commit introduced the hosts_file and ssl_sni GUCs and added them to
> postgresql.conf.sample, but I don't see any descriptions for them
> in config.sgml. Was that just an oversight?
That was a mistake when adding the doc portions of the patch. Thanks for the
report, I'll work on a patch.
--
Daniel Gustafsson
^ permalink raw reply [nested|flat] 6+ messages in thread
* Re: pgsql: ssl: Serverside SNI support for libpq
2026-03-18 11:48 pgsql: ssl: Serverside SNI support for libpq Daniel Gustafsson <[email protected]>
2026-04-10 15:34 ` Re: pgsql: ssl: Serverside SNI support for libpq Fujii Masao <[email protected]>
2026-04-10 18:23 ` Re: pgsql: ssl: Serverside SNI support for libpq Daniel Gustafsson <[email protected]>
@ 2026-04-13 08:24 ` Daniel Gustafsson <[email protected]>
2026-04-16 03:49 ` Re: pgsql: ssl: Serverside SNI support for libpq Fujii Masao <[email protected]>
0 siblings, 1 reply; 6+ messages in thread
From: Daniel Gustafsson @ 2026-04-13 08:24 UTC (permalink / raw)
To: Fujii Masao <[email protected]>; +Cc: [email protected]
> On 10 Apr 2026, at 20:23, Daniel Gustafsson <[email protected]> wrote:
>
>> On 10 Apr 2026, at 18:34, Fujii Masao <[email protected]> wrote:
>>
>> On Wed, Mar 18, 2026 at 8:48 PM Daniel Gustafsson
>> <[email protected]> wrote:
>>>
>>> ssl: Serverside SNI support for libpq
>>
>> This commit introduced the hosts_file and ssl_sni GUCs and added them to
>> postgresql.conf.sample, but I don't see any descriptions for them
>> in config.sgml. Was that just an oversight?
>
> That was a mistake when adding the doc portions of the patch. Thanks for the
> report, I'll work on a patch.
Attached is what I have planned for this, it adds the GUCs as well as tidies up
the existing SSL SNI docs a bit.
--
Daniel Gustafsson
Attachments:
[application/octet-stream] v1-0001-doc-Add-missing-GUCs-to-SSL-SNI-docs.patch (8.3K, ../../[email protected]/2-v1-0001-doc-Add-missing-GUCs-to-SSL-SNI-docs.patch)
download | inline diff:
From 1d70bf610bfe53b12c6f616261605fd23c4753fc Mon Sep 17 00:00:00 2001
From: Daniel Gustafsson <[email protected]>
Date: Mon, 13 Apr 2026 10:08:49 +0200
Subject: [PATCH v1] doc: Add missing GUCs to SSL SNI docs
The ssl_sni and hosts_file GUCs were missing from the configuration
section of the documentation, they were only described in the main
SSL SNI subsection. This adds the GUCs to the relevant sections as
well as rewords the existing SSL SNI documentation to refer to the
settings along with a few smaller fixups.
Author: Daniel Gustafsson <[email protected]>
Reported-by: Fujii Masao <[email protected]>
Discussion: https://postgr.es/m/CAHGQGwESD2Pty+J1kP3mXmWwMKZ5uJmknZdJsSGrMSRR6CQBmw@mail.gmail.com
---
doc/src/sgml/config.sgml | 45 +++++++++++++++++++++++++++++++++++----
doc/src/sgml/runtime.sgml | 29 ++++++++++++-------------
2 files changed, 55 insertions(+), 19 deletions(-)
diff --git a/doc/src/sgml/config.sgml b/doc/src/sgml/config.sgml
index 009295f20e9..67da9a1de66 100644
--- a/doc/src/sgml/config.sgml
+++ b/doc/src/sgml/config.sgml
@@ -507,9 +507,10 @@ include_dir 'conf.d'
<para>
In addition to the <filename>postgresql.conf</filename> file
already mentioned, <productname>PostgreSQL</productname> uses
- two other manually-edited configuration files, which control
+ three other manually-edited configuration files, which control
client authentication (their use is discussed in <xref
- linkend="client-authentication"/>). By default, all three
+ linkend="client-authentication"/>) and SSL host configuration.
+ By default, all four
configuration files are stored in the database cluster's data
directory. The parameters described in this section allow the
configuration files to be placed elsewhere. (Doing so can ease
@@ -579,6 +580,22 @@ include_dir 'conf.d'
</listitem>
</varlistentry>
+ <varlistentry id="guc-hosts-file" xreflabel="hosts_file">
+ <term><varname>hosts_file</varname> (<type>string</type>)
+ <indexterm>
+ <primary><varname>hosts_file</varname> configuration parameter</primary>
+ </indexterm>
+ </term>
+ <listitem>
+ <para>
+ Specifies the configuration file for host-based SSL configuration
+ (customarily called <filename>pg_hosts.conf</filename>).
+ This parameter can only be set at server start. See also
+ <xref linkend="ssl-sni"/>.
+ </para>
+ </listitem>
+ </varlistentry>
+
<varlistentry id="guc-external-pid-file" xreflabel="external_pid_file">
<term><varname>external_pid_file</varname> (<type>string</type>)
<indexterm>
@@ -620,10 +637,11 @@ include_dir 'conf.d'
<para>
If you wish, you can specify the configuration file names and locations
individually using the parameters <varname>config_file</varname>,
- <varname>hba_file</varname> and/or <varname>ident_file</varname>.
+ <varname>hba_file</varname>, <varname>ident_file</varname> and/or
+ <varname>hosts_file</varname>.
<varname>config_file</varname> can only be specified on the
<command>postgres</command> command line, but the others can be
- set within the main configuration file. If all three parameters plus
+ set within the main configuration file. If all four parameters plus
<varname>data_directory</varname> are explicitly set, then it is not necessary
to specify <option>-D</option> or <envar>PGDATA</envar>.
</para>
@@ -1734,6 +1752,25 @@ include_dir 'conf.d'
</para>
</listitem>
</varlistentry>
+
+ <varlistentry id="guc-ssl-sni" xreflabel="ssl_sni">
+ <term><varname>ssl_sni</varname> (<type>boolean</type>)
+ <indexterm>
+ <primary><varname>ssl_sni</varname> configuration parameter</primary>
+ </indexterm>
+ </term>
+ <listitem>
+ <para>
+ Enables SNI configuration for SSL connections. When set to <literal>on</literal>
+ host configuration from <xref linkend="guc-hosts-file"/> is used, see
+ <xref linkend="ssl-sni"/> for more details.
+ </para>
+ <para>
+ This parameter can only be set in the <filename>postgresql.conf</filename>
+ file or on the server command line. The default is <literal>off</literal>.
+ </para>
+ </listitem>
+ </varlistentry>
</variablelist>
</sect2>
</sect1>
diff --git a/doc/src/sgml/runtime.sgml b/doc/src/sgml/runtime.sgml
index 8576ae325d4..b01e74638c4 100644
--- a/doc/src/sgml/runtime.sgml
+++ b/doc/src/sgml/runtime.sgml
@@ -2602,18 +2602,16 @@ openssl x509 -req -in server.csr -text -days 365 \
<para>
<productname>PostgreSQL</productname> can be configured for Server Name
- Indication, <acronym>SNI</acronym>, using the <filename>pg_hosts.conf</filename>
- configuration file. <productname>PostgreSQL</productname> inspects the TLS
- hostname extension in the SSL connection handshake, and selects the right
- TLS certificate, key and CA certificate to use for the connection based on
- entries in the configuration file <filename>pg_hosts.conf</filename>.
+ Indication, <acronym>SNI</acronym>, using the <xref linkend="guc-ssl-sni"/>
+ configuration parameter. <productname>PostgreSQL</productname> inspects the
+ TLS hostname extension in the SSL connection handshake, and selects the
+ right certificate, key and CA certificate to use for the connection based
+ on entries in the <xref linkend="guc-hosts-file"/> configuration file.
</para>
<para>
- SNI configuration is defined in the hosts configuration file,
- <filename>pg_hosts.conf</filename>, which is stored in the cluster's
- data directory. The hosts configuration file contains lines of these
- general forms:
+ The <xref linkend="guc-hosts-file"/> configuration file contains lines of
+ these general forms:
<synopsis>
<replaceable>hostname</replaceable> <replaceable>SSL_certificate</replaceable> <replaceable>SSL_key</replaceable> <optional> <replaceable>SSL_CA_certificate</replaceable> <optional> <replaceable>SSL_passphrase_cmd</replaceable> <optional> <replaceable>SSL_passphrase_cmd_reload</replaceable> </optional> </optional> </optional>
<literal>include</literal> <replaceable>file</replaceable>
@@ -2622,8 +2620,9 @@ openssl x509 -req -in server.csr -text -days 365 \
</synopsis>
Comments, whitespace, line continuations, and inclusion directives are
handled in the same way as
- in <filename>pg_hba.conf</filename>. <replaceable>hostname</replaceable>
- is matched against the hostname TLS extension in the SSL handshake.
+ in <xref linkend="guc-hba-file"/>. <replaceable>hostname</replaceable>
+ is matched case-insensitively against the <literal>hostname</literal> TLS
+ extension in the SSL handshake.
<replaceable>SSL_certificate</replaceable>,
<replaceable>SSL_key</replaceable>,
<replaceable>SSL_CA_certificate</replaceable>,
@@ -2655,7 +2654,7 @@ openssl x509 -req -in server.csr -text -days 365 \
<thead>
<row>
<entry>Host Entry</entry>
- <entry>sslsni</entry>
+ <entry>Hostname extension</entry>
<entry>Description</entry>
</row>
</thead>
@@ -2695,9 +2694,9 @@ openssl x509 -req -in server.csr -text -days 365 \
</para>
<para>
- If <filename>pg_hosts.conf</filename> is empty or missing, then the SSL
+ If <xref linkend="guc-hosts-file"/> is empty or missing, then the SSL
configuration in <filename>postgresql.conf</filename> will be used for all
- connections. If <filename>pg_hosts.conf</filename> is non-empty then it
+ connections. If <xref linkend="guc-hosts-file"/> is non-empty then it
will take precedence over certificate and key settings in
<filename>postgresql.conf</filename>.
</para>
@@ -2705,7 +2704,7 @@ openssl x509 -req -in server.csr -text -days 365 \
<para>
It is currently not possible to set different <literal>clientname</literal>
values for the different certificates. Any <literal>clientname</literal>
- setting in <filename>pg_hba.conf</filename> will be applied during
+ setting in <xref linkend="guc-hba-file"/> will be applied during
authentication regardless of which set of certificates have been loaded
via an SNI enabled connection.
</para>
--
2.39.3 (Apple Git-146)
^ permalink raw reply [nested|flat] 6+ messages in thread
* Re: pgsql: ssl: Serverside SNI support for libpq
2026-03-18 11:48 pgsql: ssl: Serverside SNI support for libpq Daniel Gustafsson <[email protected]>
2026-04-10 15:34 ` Re: pgsql: ssl: Serverside SNI support for libpq Fujii Masao <[email protected]>
2026-04-10 18:23 ` Re: pgsql: ssl: Serverside SNI support for libpq Daniel Gustafsson <[email protected]>
2026-04-13 08:24 ` Re: pgsql: ssl: Serverside SNI support for libpq Daniel Gustafsson <[email protected]>
@ 2026-04-16 03:49 ` Fujii Masao <[email protected]>
2026-04-16 09:26 ` Re: pgsql: ssl: Serverside SNI support for libpq Daniel Gustafsson <[email protected]>
0 siblings, 1 reply; 6+ messages in thread
From: Fujii Masao @ 2026-04-16 03:49 UTC (permalink / raw)
To: Daniel Gustafsson <[email protected]>; +Cc: [email protected]
On Mon, Apr 13, 2026 at 5:24 PM Daniel Gustafsson <[email protected]> wrote:
> Attached is what I have planned for this, it adds the GUCs as well as tidies up
> the existing SSL SNI docs a bit.
LGTM. Thanks!
Regards,
--
Fujii Masao
^ permalink raw reply [nested|flat] 6+ messages in thread
* Re: pgsql: ssl: Serverside SNI support for libpq
2026-03-18 11:48 pgsql: ssl: Serverside SNI support for libpq Daniel Gustafsson <[email protected]>
2026-04-10 15:34 ` Re: pgsql: ssl: Serverside SNI support for libpq Fujii Masao <[email protected]>
2026-04-10 18:23 ` Re: pgsql: ssl: Serverside SNI support for libpq Daniel Gustafsson <[email protected]>
2026-04-13 08:24 ` Re: pgsql: ssl: Serverside SNI support for libpq Daniel Gustafsson <[email protected]>
2026-04-16 03:49 ` Re: pgsql: ssl: Serverside SNI support for libpq Fujii Masao <[email protected]>
@ 2026-04-16 09:26 ` Daniel Gustafsson <[email protected]>
0 siblings, 0 replies; 6+ messages in thread
From: Daniel Gustafsson @ 2026-04-16 09:26 UTC (permalink / raw)
To: Fujii Masao <[email protected]>; +Cc: [email protected]
> On 16 Apr 2026, at 05:49, Fujii Masao <[email protected]> wrote:
>
> On Mon, Apr 13, 2026 at 5:24 PM Daniel Gustafsson <[email protected]> wrote:
>> Attached is what I have planned for this, it adds the GUCs as well as tidies up
>> the existing SSL SNI docs a bit.
>
> LGTM. Thanks!
Thanks for review, pushed to master.
--
Daniel Gustafsson
^ permalink raw reply [nested|flat] 6+ messages in thread
end of thread, other threads:[~2026-04-16 09:26 UTC | newest]
Thread overview: 6+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2026-03-18 11:48 pgsql: ssl: Serverside SNI support for libpq Daniel Gustafsson <[email protected]>
2026-04-10 15:34 ` Fujii Masao <[email protected]>
2026-04-10 18:23 ` Daniel Gustafsson <[email protected]>
2026-04-13 08:24 ` Daniel Gustafsson <[email protected]>
2026-04-16 03:49 ` Fujii Masao <[email protected]>
2026-04-16 09:26 ` Daniel Gustafsson <[email protected]>
This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox