Subject: Re: SSL SNI
To: Jesse Zhang <sbjesse@gmail.com>
References: <7289d5eb-62a5-a732-c3b9-438cee2cb709@enterprisedb.com>
 <CAGf+fX7H+jYYJAbdc=E2WK5bG=gbdr_ZCziJt_7QvMvj5t71zQ@mail.gmail.com>
Cc: pgsql-hackers <pgsql-hackers@postgresql.org>
From: Peter Eisentraut <peter.eisentraut@enterprisedb.com>
Organization: EnterpriseDB
Message-ID: <5bf09acd-fcd8-052a-ae68-a51d7e02c458@enterprisedb.com>
Date: Mon, 15 Feb 2021 20:24:56 +0100
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:52.0)
 Gecko/20100101 Thunderbird/52.9.1
MIME-Version: 1.0
In-Reply-To: 
 <CAGf+fX7H+jYYJAbdc=E2WK5bG=gbdr_ZCziJt_7QvMvj5t71zQ@mail.gmail.com>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Language: en-US
Content-Transfer-Encoding: 7bit
Precedence: bulk

On 2021-02-15 18:40, Jesse Zhang wrote:
> I imagine this also (finally) opens up the possibility for the server
> to present a different certificate for each hostname based on SNI.
> This eliminates the requirement for wildcard certs where the cluster
> is running on a host with multiple (typically two to three) hostnames
> and the clients check the hostname against SAN in the cert
> (sslmode=verify-full). Am I right? Is that feature on anybody's
> roadmap?

This would be the client side of that.  But I don't know of anyone 
planning to work on the server side.