MIME-Version: 1.0
References: <ZiH7vHwEJeRKHlST@paquier.xyz> <c786e226-4039-4522-ba07-92501fce9b6a@iki.fi>
 <CAOYmi+kbYPX78nu0k7OODxUhoD6H1OXdugiMK1z9Nn33G-qdcQ@mail.gmail.com>
 <a0983295-67ae-487e-84e3-6e1148af3a25@iki.fi> <CAOYmi+nv2wc+FzpSUsTQt=-hKgP9zmvXw2fbX57CbrL7SLYz-w@mail.gmail.com>
 <6aedcaa5-60f3-49af-a857-2c76ba55a1f3@iki.fi> <CAOYmi+n2q8rxv9vUirMemMNhiQTRWbSGJpWFO4biQ9FKTrLMXg@mail.gmail.com>
In-Reply-To: <CAOYmi+n2q8rxv9vUirMemMNhiQTRWbSGJpWFO4biQ9FKTrLMXg@mail.gmail.com>
From: Jacob Champion <jacob.champion@enterprisedb.com>
Date: Tue, 14 May 2024 10:14:38 -0700
Message-ID: <CAOYmi+kuXZTA-_RR_HocVia38dt0O1T3K7quUuVV+mbFD0jw9w@mail.gmail.com>
Subject: Re: Direct SSL connection with ALPN and HBA rules
To: Heikki Linnakangas <hlinnaka@iki.fi>
Cc: Michael Paquier <michael@paquier.xyz>, 
	Postgres hackers <pgsql-hackers@lists.postgresql.org>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Archived-At: <https://www.postgresql.org/message-id/CAOYmi%2BkuXZTA-_RR_HocVia38dt0O1T3K7quUuVV%2BmbFD0jw9w%40mail.gmail.com>
Precedence: bulk

On Mon, Apr 29, 2024 at 11:04=E2=80=AFAM Jacob Champion
<jacob.champion@enterprisedb.com> wrote:
> On Fri, Apr 26, 2024 at 3:51=E2=80=AFPM Heikki Linnakangas <hlinnaka@iki.=
fi> wrote:
> > Unfortunately the error message you got in the client with that was
> > horrible (I modified the server to not accept the 'postgresql' protocol=
):
> >
> > psql "dbname=3Dpostgres sslmode=3Drequire host=3Dlocalhost"
> > psql: error: connection to server at "localhost" (::1), port 5432
> > failed: SSL error: SSL error code 167773280
>
> <long sigh>
>
> I filed a bug upstream [1].

I think this is on track to be fixed in a future set of OpenSSL 3.x
releases [2]. We'll still need to carry the workaround while we
support 1.1.1.

--Jacob

[2] https://github.com/openssl/openssl/pull/24351