From: Peter Eisentraut <peter.eisentraut@enterprisedb.com>
To: Jesse Zhang <sbjesse@gmail.com>
Cc: pgsql-hackers <pgsql-hackers@postgresql.org>
Subject: Re: SSL SNI
Date: Mon, 15 Feb 2021 20:24:56 +0100
Message-ID: <5bf09acd-fcd8-052a-ae68-a51d7e02c458@enterprisedb.com> (raw)
In-Reply-To: <CAGf+fX7H+jYYJAbdc=E2WK5bG=gbdr_ZCziJt_7QvMvj5t71zQ@mail.gmail.com>
References: <7289d5eb-62a5-a732-c3b9-438cee2cb709@enterprisedb.com>
<CAGf+fX7H+jYYJAbdc=E2WK5bG=gbdr_ZCziJt_7QvMvj5t71zQ@mail.gmail.com>
On 2021-02-15 18:40, Jesse Zhang wrote:
> I imagine this also (finally) opens up the possibility for the server
> to present a different certificate for each hostname based on SNI.
> This eliminates the requirement for wildcard certs where the cluster
> is running on a host with multiple (typically two to three) hostnames
> and the clients check the hostname against SAN in the cert
> (sslmode=verify-full). Am I right? Is that feature on anybody's
> roadmap?
This would be the client side of that. But I don't know of anyone
planning to work on the server side.
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: peter.eisentraut@enterprisedb.com, sbjesse@gmail.com
Subject: Re: SSL SNI
In-Reply-To: <5bf09acd-fcd8-052a-ae68-a51d7e02c458@enterprisedb.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox