Subject: Re: Is it worth accepting multiple CRLs?
To: Kyotaro Horiguchi <horikyota.ntt@gmail.com>
References: <20210119.173200.1687041891704633506.horikyota.ntt@gmail.com>
 <516cf19c-840b-3db6-3320-4145d49c24d8@enterprisedb.com>
 <20210201.114232.1425888258279369778.horikyota.ntt@gmail.com>
 <20210217.130526.621475320443052460.horikyota.ntt@gmail.com>
Cc: sfrost@snowman.net, pgsql-hackers@postgresql.org
From: Peter Eisentraut <peter.eisentraut@enterprisedb.com>
Organization: EnterpriseDB
Message-ID: <554b446f-a210-cadc-24a1-079d88872468@enterprisedb.com>
Date: Thu, 18 Feb 2021 08:24:23 +0100
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:52.0)
 Gecko/20100101 Thunderbird/52.9.1
MIME-Version: 1.0
In-Reply-To: <20210217.130526.621475320443052460.horikyota.ntt@gmail.com>
Content-Type: text/plain; charset=windows-1252; format=flowed
Content-Language: en-US
Content-Transfer-Encoding: 7bit
Precedence: bulk

On 2021-02-17 05:05, Kyotaro Horiguchi wrote:
> The commit fe61df7f82 shot down this.
> 
> This patch allows a new GUC ssl_crl_dir and a new libpq connection
> option sslcrldir to specify CRL directory, which stores multiple files
> that contains one CRL. With that method server loads only CRLs for the
> CA of the certificate being validated.
> 
> Along with rebasing, the documentation is slightly reworded.

Committed this.

I changed the documentation a bit.  Instead of having a separate section 
describing the CRL options, I put that information directly into the 
libpq and GUC sections.  Some of the information, such as that the 
directory files are loaded on demand, isn't so obviously useful in the 
libpq case, so I found that a bit confusing.  Also, I got the impression 
that the hashed directory format is sort of internal to OpenSSL, and 
there are several versions of that format, so I didn't want to copy over 
the description of these internals.  Instead, I referred to the openssl 
rehash/c_rehash commands for information.  If we get support for 
non-OpenSSL providers, we'll probably have to revisit this.