From: Tom Lane <tgl@sss.pgh.pa.us>
To: Casey & Gina <cg@osss.net>
cc: pgsql-general@postgresql.org
Subject: Re: Question about UNIX socket connections and SSL
In-reply-to: <5EDB1F7F-569B-48B2-8DCD-44EE17D41F1A@osss.net>
References: <5EDB1F7F-569B-48B2-8DCD-44EE17D41F1A@osss.net>
Comments: In-reply-to Casey & Gina <cg@osss.net>
	message dated "Wed, 12 Jun 2024 10:34:56 -0500"
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <1514892.1718219853.1@sss.pgh.pa.us>
Date: Wed, 12 Jun 2024 15:17:33 -0400
Message-ID: <1514893.1718219853@sss.pgh.pa.us>
Archived-At: <https://www.postgresql.org/message-id/1514893.1718219853%40sss.pgh.pa.us>
Precedence: bulk

Casey & Gina <cg@osss.net> writes:
> So why can't I use SSL when connecting from a client to a UNIX socket?

(1) It'd add overhead without adding any security.  Data going through
a UNIX socket will only pass through the local kernel, and if that's
compromised then it's game over anyway.

(2) I'm less sure about this part, but I seem to recall that openssl
doesn't actually work if given a UNIX socket.

Maybe there are reasons why those arguments are obsolete, but you
haven't presented any.

			regards, tom lane