Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1k1Ue3-0005Vq-CR for pgsql-hackers@arkaria.postgresql.org; Fri, 31 Jul 2020 13:00:19 +0000 Received: from localhost ([127.0.0.1] helo=malur.postgresql.org) by malur.postgresql.org with esmtp (Exim 4.92) (envelope-from ) id 1k1Ue2-0002nN-B1 for pgsql-hackers@arkaria.postgresql.org; Fri, 31 Jul 2020 13:00:18 +0000 Received: from makus.postgresql.org ([2001:4800:3e1:1::229]) by malur.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1k1Ue2-0002nG-1P for pgsql-hackers@lists.postgresql.org; Fri, 31 Jul 2020 13:00:18 +0000 Received: from tamriel.snowman.net ([96.255.250.162]) by makus.postgresql.org with esmtp (Exim 4.92) (envelope-from ) id 1k1Ue0-0003fJ-5e for pgsql-hackers@postgresql.org; Fri, 31 Jul 2020 13:00:17 +0000 Received: by tamriel.snowman.net (Postfix, from userid 1000) id F08A75F79F; Fri, 31 Jul 2020 09:00:14 -0400 (EDT) Date: Fri, 31 Jul 2020 09:00:14 -0400 From: Stephen Frost To: Kyotaro Horiguchi Cc: pgsql-hackers@postgresql.org Subject: Re: Is it worth accepting multiple CRLs? Message-ID: <20200731130014.GC12375@tamriel.snowman.net> References: <20200731.173911.904649928639357911.horikyota.ntt@gmail.com> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="CTkX9836blHDdbQK" Content-Disposition: inline In-Reply-To: <20200731.173911.904649928639357911.horikyota.ntt@gmail.com> User-Agent: Mutt/1.5.24 (2015-08-30) List-Id: List-Help: List-Subscribe: List-Post: List-Owner: List-Archive: Precedence: bulk --CTkX9836blHDdbQK Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable Greetings, * Kyotaro Horiguchi (horikyota.ntt@gmail.com) wrote: > PostgreSQL server accepts only one CRL file. It is easy to expand > be_tls_init to accept a directory set in ssl_crl_file. But I'm not > sure CRL is actually even utilized in the field so that could ends > with just bloating the documentation. >=20 > Is it work doing? Yes, CRLs are absolutely used in the field and having this would be nice. Thanks, Stephen --CTkX9836blHDdbQK Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBCgAGBQJfJBXeAAoJEO1sijiDR2RVrV4P/2743lCvNoasmUbqk1CkNqDM 5pv1OYpJcJ0oQn0DDomwNW1QhWBO4HyIM6KrawcY/54PBDegcIPdDdtVMIjmjkER xBLr0NR0x/ilR5y4Jd9+a+7TusVACFzTEEFczZG8woC0M0C3KHbhp/QPvtjxbBKQ 6tIF1EqYSt4gyg1HXI4vQrqpRw8An3FDM9l+5c5QFHKUamBDE2c6tnEZ9fdRKUTH CzZw8kUuNBdOwZmvElefVO1AmyOFZ3Qu4IPVMI8aXqSnHEB7y86PZ2m7GAjFbOTU xqvNxe/8dCFx3TzNYsWk0tBnz2XcZ25+ZEp9TW4kXPlAXeojQazHNoTUIgDoXeGW zAiy+ncciC1q7C3vIhV25Id47AaERF1IipWHfEGA+jU6ORQJyTOEibN//DrM6J1o qPo6m2bcIU9Zu4ovI5OUb/ypfpOEUQH86LEszV4zb/Lh+d8fr8w/S4WqD+nYRgDy i+YwHn5MPdGLUuDDwC5tnTRd4NyqQMG/nJZSoVQ3AELadxzfFAWBnK1LkgmsoNgJ cC2fWplB4LMmz/maIxQ9mLUnqUYQth3PnnDQLaz+I+fVL/23zGMdd3X3yvcKtiHW tb8D0HNWQ+YjFbq8yd6T7n2GW77BuKHVjiH2dq6UE/vvf881AOviagKqrBo2w/x+ 28oRaWKdfG45aTxMEfTl =LNjv -----END PGP SIGNATURE----- --CTkX9836blHDdbQK--