From: Stephen Frost <sfrost@snowman.net>
To: Heikki Linnakangas <hlinnakangas@vmware.com>
Cc: Andres Freund <andres@2ndquadrant.com>
Cc: PostgreSQL-development <pgsql-hackers@postgreSQL.org>
Subject: Re: PQgetssl() and alternative SSL implementations
Date: Tue, 19 Aug 2014 15:26:56 -0400
Message-ID: <20140819192656.GL16422@tamriel.snowman.net> (raw)
In-Reply-To: <53F37B7E.30300@vmware.com>
References: <53F1E989.8020609@vmware.com>
<20140819144841.GA16422@tamriel.snowman.net>
<20140819145547.GB30525@awork2.anarazel.de>
<20140819150507.GB16422@tamriel.snowman.net>
<20140819152613.GC30525@awork2.anarazel.de>
<20140819155237.GE16422@tamriel.snowman.net>
<53F37B7E.30300@vmware.com>
List-Unsubscribe: <mailto:majordomo@postgresql.org?body=unsub%20pgsql-hackers>
* Heikki Linnakangas (hlinnakangas@vmware.com) wrote:
> I think you just packed up the goalposts for a one-way trip to Mars,
> but I wonder: What would you consider "proper SSL support"? What
> exactly are we missing?
I hit on a few things in my other email, but there is a huge portion of
SSL which is just about making it easy and sensible to install and get
working properly. Apache is a good example of how to do this and is one
that a lot of people are familiar with. Specific issues that I recall
running into are lack of the 'directory' options for certificates,
having trouble figuring out the right format and structure to provide
the complete root chain for the server's certificate and then trying to
figure out how to add intermediate and additional root CAs for client
certificates, getting CRLs to work was a pain, and nothing about how to
get OCSP working.
I think there's been some improvement since I last had to go through the
pain of setting this all up, and some of it is undoubtably OpenSSL's
fault, but there's definitely quite a bit more we could be doing to make
SSL support easier. I'm hopeful that I'll be able to spend more time on
this in the future but it's not a priority currently.
Thanks,
Stephen
Attachments:
signature.asc (application/pgp-signature, 818B) download
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: sfrost@snowman.net, hlinnakangas@vmware.com, andres@2ndquadrant.com
Subject: Re: PQgetssl() and alternative SSL implementations
In-Reply-To: <20140819192656.GL16422@tamriel.snowman.net>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox