From: Tom Lane <tgl@sss.pgh.pa.us>
To: Michael Paquier <michael@paquier.xyz>
cc: Daniel Gustafsson <daniel@yesql.se>,
        Peter Eisentraut <peter.eisentraut@2ndquadrant.com>,
        pgsql-hackers <pgsql-hackers@postgresql.org>
Subject: Re: should libpq also require TLSv1.2 by default?
In-reply-to: <20200625015026.GE130132@paquier.xyz>
References: <a9408304-4381-a5af-d259-e55d349ae4ce@2ndquadrant.com>
 <4FBC50DB-599A-42AA-90C8-3051E3A748BB@yesql.se>
 <64437c39-c5fb-d799-f3d3-b638e34c1dd2@2ndquadrant.com>
 <003BDF1F-FC7A-4901-BBC0-33A44FE07A89@yesql.se>
 <20200625015026.GE130132@paquier.xyz>
Comments: In-reply-to Michael Paquier <michael@paquier.xyz>
	message dated "Thu, 25 Jun 2020 10:50:26 +0900"
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <2244432.1593053439.1@sss.pgh.pa.us>
Content-Transfer-Encoding: quoted-printable
Date: Wed, 24 Jun 2020 22:50:39 -0400
Message-ID: <2244433.1593053439@sss.pgh.pa.us>
Precedence: bulk

Michael Paquier <michael@paquier.xyz> writes:
> On Thu, Jun 25, 2020 at 12:30:03AM +0200, Daniel Gustafsson wrote:
>> As mentioned elsewhere in the thread, maybe this is also something whic=
h can be
>> done more easily if we improve the error reporting?  Right now it's fai=
rly
>> cryptic IMO.

> This part may be tricky to get right I think, because the error comes
> directly from OpenSSL when negotiating the protocol used between the
> client and the server, like "no protocols available" or such.

Can we do something comparable to the backend's HINT protocol, where
we add on a comment that's only mostly-likely to be right?

			regards, tom lane