From: Peter Eisentraut <peter.eisentraut@enterprisedb.com>
To: pgsql-hackers@postgresql.org <pgsql-hackers@postgresql.org>
Subject: Re: SSL SNI
Date: Wed, 7 Apr 2021 15:32:55 +0200
Message-ID: <4bf3ae1c-b28e-8960-e89f-c390c5cf01a2@enterprisedb.com> (raw)
In-Reply-To: <4eaa2b56-c3d0-67b6-4716-010d001c7601@enterprisedb.com>
References: <7289d5eb-62a5-a732-c3b9-438cee2cb709@enterprisedb.com>
<ef3d4b460ae7da59a8811f4e8e8fde0cd38a6cc8.camel@vmware.com>
<9407b344-7342-b2b7-004f-d5250687be42@enterprisedb.com>
<ecb6a57d176a396feb959fbb0c53b3c794e8d8e5.camel@vmware.com>
<4eaa2b56-c3d0-67b6-4716-010d001c7601@enterprisedb.com>
On 18.03.21 12:27, Peter Eisentraut wrote:
> On 25.02.21 19:36, Jacob Champion wrote:
>> On Thu, 2021-02-25 at 17:00 +0100, Peter Eisentraut wrote:
>>> Just as additional data points, it has come to my attention that both
>>> the Go driver ("lib/pq") and the JDBC environment already send SNI
>>> automatically. (In the case of JDBC this is done by the Java system
>>> libraries, not the JDBC driver implementation.)
>>
>> For the Go case it's only for sslmode=verify-full, and only because the
>> Go standard library implementation does it for you automatically if you
>> request the builtin server hostname validation. (I checked both lib/pq
>> and its de facto replacement, jackc/pgx.) So it may not be something
>> that was done on purpose by the driver implementation.
>
> Here is a new patch with an option to turn it off, and some
> documentation added.
Committed like that. (Default to on, but it's easy to change if there
are any further thoughts.)
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: peter.eisentraut@enterprisedb.com
Subject: Re: SSL SNI
In-Reply-To: <4bf3ae1c-b28e-8960-e89f-c390c5cf01a2@enterprisedb.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox