Subject: Re: SSL SNI
From: Peter Eisentraut <peter.eisentraut@enterprisedb.com>
To: "pgsql-hackers@postgresql.org" <pgsql-hackers@postgresql.org>
References: <7289d5eb-62a5-a732-c3b9-438cee2cb709@enterprisedb.com>
 <ef3d4b460ae7da59a8811f4e8e8fde0cd38a6cc8.camel@vmware.com>
 <9407b344-7342-b2b7-004f-d5250687be42@enterprisedb.com>
 <ecb6a57d176a396feb959fbb0c53b3c794e8d8e5.camel@vmware.com>
 <4eaa2b56-c3d0-67b6-4716-010d001c7601@enterprisedb.com>
Message-ID: <4bf3ae1c-b28e-8960-e89f-c390c5cf01a2@enterprisedb.com>
Date: Wed, 7 Apr 2021 15:32:55 +0200
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:78.0)
 Gecko/20100101 Thunderbird/78.9.0
MIME-Version: 1.0
In-Reply-To: <4eaa2b56-c3d0-67b6-4716-010d001c7601@enterprisedb.com>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Language: en-US
Content-Transfer-Encoding: 8bit
Archived-At: 
 <https://www.postgresql.org/message-id/4bf3ae1c-b28e-8960-e89f-c390c5cf01a2%40enterprisedb.com>
Precedence: bulk

On 18.03.21 12:27, Peter Eisentraut wrote:
> On 25.02.21 19:36, Jacob Champion wrote:
>> On Thu, 2021-02-25 at 17:00 +0100, Peter Eisentraut wrote:
>>> Just as additional data points, it has come to my attention that both
>>> the Go driver ("lib/pq") and the JDBC environment already send SNI
>>> automatically.  (In the case of JDBC this is done by the Java system
>>> libraries, not the JDBC driver implementation.)
>>
>> For the Go case it's only for sslmode=verify-full, and only because the
>> Go standard library implementation does it for you automatically if you
>> request the builtin server hostname validation. (I checked both lib/pq
>> and its de facto replacement, jackc/pgx.) So it may not be something
>> that was done on purpose by the driver implementation.
> 
> Here is a new patch with an option to turn it off, and some 
> documentation added.

Committed like that.  (Default to on, but it's easy to change if there 
are any further thoughts.)