From: Peter Eisentraut <peter.eisentraut@enterprisedb.com>
To: Kyotaro Horiguchi <horikyota.ntt@gmail.com>
Cc: sfrost@snowman.net
Cc: pgsql-hackers@postgresql.org
Subject: Re: Is it worth accepting multiple CRLs?
Date: Thu, 18 Feb 2021 08:24:23 +0100
Message-ID: <554b446f-a210-cadc-24a1-079d88872468@enterprisedb.com> (raw)
In-Reply-To: <20210217.130526.621475320443052460.horikyota.ntt@gmail.com>
References: <20210119.173200.1687041891704633506.horikyota.ntt@gmail.com>
<516cf19c-840b-3db6-3320-4145d49c24d8@enterprisedb.com>
<20210201.114232.1425888258279369778.horikyota.ntt@gmail.com>
<20210217.130526.621475320443052460.horikyota.ntt@gmail.com>
On 2021-02-17 05:05, Kyotaro Horiguchi wrote:
> The commit fe61df7f82 shot down this.
>
> This patch allows a new GUC ssl_crl_dir and a new libpq connection
> option sslcrldir to specify CRL directory, which stores multiple files
> that contains one CRL. With that method server loads only CRLs for the
> CA of the certificate being validated.
>
> Along with rebasing, the documentation is slightly reworded.
Committed this.
I changed the documentation a bit. Instead of having a separate section
describing the CRL options, I put that information directly into the
libpq and GUC sections. Some of the information, such as that the
directory files are loaded on demand, isn't so obviously useful in the
libpq case, so I found that a bit confusing. Also, I got the impression
that the hashed directory format is sort of internal to OpenSSL, and
there are several versions of that format, so I didn't want to copy over
the description of these internals. Instead, I referred to the openssl
rehash/c_rehash commands for information. If we get support for
non-OpenSSL providers, we'll probably have to revisit this.
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: peter.eisentraut@enterprisedb.com, horikyota.ntt@gmail.com, sfrost@snowman.net
Subject: Re: Is it worth accepting multiple CRLs?
In-Reply-To: <554b446f-a210-cadc-24a1-079d88872468@enterprisedb.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox