Date: Tue, 19 Aug 2014 15:26:56 -0400
From: Stephen Frost <sfrost@snowman.net>
To: Heikki Linnakangas <hlinnakangas@vmware.com>
Cc: Andres Freund <andres@2ndquadrant.com>,
 PostgreSQL-development <pgsql-hackers@postgreSQL.org>
Subject: Re: PQgetssl() and alternative SSL implementations
Message-ID: <20140819192656.GL16422@tamriel.snowman.net>
References: <53F1E989.8020609@vmware.com>
 <20140819144841.GA16422@tamriel.snowman.net>
 <20140819145547.GB30525@awork2.anarazel.de>
 <20140819150507.GB16422@tamriel.snowman.net>
 <20140819152613.GC30525@awork2.anarazel.de>
 <20140819155237.GE16422@tamriel.snowman.net>
 <53F37B7E.30300@vmware.com>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha1;
 protocol="application/pgp-signature"; boundary="W7nAyMVzqpsNaj1c"
Content-Disposition: inline
In-Reply-To: <53F37B7E.30300@vmware.com>
User-Agent: Mutt/1.5.21 (2010-09-15)
Precedence: bulk
Sender: pgsql-hackers-owner@postgresql.org


--W7nAyMVzqpsNaj1c
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline

* Heikki Linnakangas (hlinnakangas@vmware.com) wrote:
> I think you just packed up the goalposts for a one-way trip to Mars,
> but I wonder: What would you consider "proper SSL support"? What
> exactly are we missing?

I hit on a few things in my other email, but there is a huge portion of
SSL which is just about making it easy and sensible to install and get
working properly.  Apache is a good example of how to do this and is one
that a lot of people are familiar with.  Specific issues that I recall
running into are lack of the 'directory' options for certificates,
having trouble figuring out the right format and structure to provide
the complete root chain for the server's certificate and then trying to
figure out how to add intermediate and additional root CAs for client
certificates, getting CRLs to work was a pain, and nothing about how to
get OCSP working.

I think there's been some improvement since I last had to go through the
pain of setting this all up, and some of it is undoubtably OpenSSL's
fault, but there's definitely quite a bit more we could be doing to make
SSL support easier.  I'm hopeful that I'll be able to spend more time on
this in the future but it's not a priority currently.

	Thanks,

		Stephen

--W7nAyMVzqpsNaj1c
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBAgAGBQJT86UAAAoJEO1sijiDR2RVzo8P/0DgG/RX1RvgCj7n6ZjvT1tp
LPpHmpH9mqZ1i5U5Vgau+S9WYchUcfYniGin0cFTWYN16GJhlIXvAhIlUcCkTYfl
PGP4Jr6NtIvVwIM4gWOcVdp+gv9DL4sg9DTL0ZhaMbriq/JpoatBH4uHofNruiZt
cZWKSBtW8vbx9B30HY3C1XGsaDITpZOfEWDFFDX4SrVav1MXvB9otOdOspkQx3En
94rgaK7wSjJDASuJ4kF22tocZo+KERx/nLyDdSKx2wY3sc7lMC6pHgAXJ2jwz12Q
usHXQuInym6PgOYh+puWTWa4xk/5K0Q/w62Lnu+Ejc3hV+D07t/VSiWkgF7jBt3I
uj1+PxOOSR8CsYelKBM8AbgmvUG4gGsrH1ggfL2ZT4qCRiuY3o4oWN17Yc0im9Q8
OzdVXuTNRWdEVFj6TIpm2os95iM6kWJHhM3QYLk6cOMoIeEeJRx1SUGl0fgoxIaw
KavDzLCXFAiZfbUAcCtATZWepPcwVWCUTB7piuy0LzhlvI+Geb4g5SuTDzj1UOAe
dYa3oxp+q3cb2kyDsfCong02unoJLuqOY0ME/ZGgcQr2SP2ajoudpqZMAayhoLuH
WRyLNDn85s4YvSxZvaBv/RCbpGB2fqWVnLn4b5HZQZ79QjjdA1CW9nSfsq2K/UG3
j0TTcXEYA0HD3mBsNyO0
=AysH
-----END PGP SIGNATURE-----

--W7nAyMVzqpsNaj1c--