Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1s1kRu-00EZ8S-GF for pgsql-hackers@arkaria.postgresql.org; Tue, 30 Apr 2024 10:10:58 +0000 Received: from localhost ([127.0.0.1] helo=malur.postgresql.org) by malur.postgresql.org with esmtp (Exim 4.94.2) (envelope-from ) id 1s1kRs-005dMe-0W for pgsql-hackers@arkaria.postgresql.org; Tue, 30 Apr 2024 10:10:56 +0000 Received: from makus.postgresql.org ([2001:4800:3e1:1::229]) by malur.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1s1kRr-005dMW-Mt for pgsql-hackers@lists.postgresql.org; Tue, 30 Apr 2024 10:10:56 +0000 Received: from smtp.outgoing.loopia.se ([93.188.3.37]) by makus.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1s1kRp-000l2r-5v for pgsql-hackers@lists.postgresql.org; Tue, 30 Apr 2024 10:10:55 +0000 Received: from s807.loopia.se (localhost [127.0.0.1]) by s807.loopia.se (Postfix) with ESMTP id A1AC53012CDE for ; Tue, 30 Apr 2024 12:10:49 +0200 (CEST) Received: from s899.loopia.se (unknown [172.22.191.6]) by s807.loopia.se (Postfix) with ESMTP id 911F42E2C32E; Tue, 30 Apr 2024 12:10:49 +0200 (CEST) Received: from s471.loopia.se (unknown [172.22.191.5]) by s899.loopia.se (Postfix) with ESMTP id 8C6F62C8BADB; Tue, 30 Apr 2024 12:10:49 +0200 (CEST) X-Virus-Scanned: amavisd-new at amavis.loopia.se X-Spam-Flag: NO X-Spam-Score: -1.2 X-Spam-Level: X-Spam-Status: No, score=-1.2 tagged_above=-999 required=6.2 tests=[ALL_TRUSTED=-1, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1] autolearn=disabled Authentication-Results: s471.loopia.se (amavisd-new); dkim=pass (2048-bit key) header.d=yesql.se Received: from s934.loopia.se ([172.22.191.6]) by s471.loopia.se (s471.loopia.se [172.22.190.35]) (amavisd-new, port 10024) with LMTP id zQwdclHe-mYJ; Tue, 30 Apr 2024 12:10:49 +0200 (CEST) X-Loopia-Auth: user X-Loopia-User: daniel@yesql.se X-Loopia-Originating-IP: 89.255.232.193 Received: from smtpclient.apple (customer-89-255-232-193.stosn.net [89.255.232.193]) (Authenticated sender: daniel@yesql.se) by s934.loopia.se (Postfix) with ESMTPSA id 063CE7CEAC8; Tue, 30 Apr 2024 12:10:49 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yesql.se; s=loopiadkim1707475645; t=1714471849; bh=XLTjwUs558UWYGfJNITKoNOODefYezP7KLDQukBnbAk=; h=Subject:From:In-Reply-To:Date:Cc:References:To; b=tLgrfG+RGfzZYay6Nf2PbgKLs1ISkkki9gbl7WL0Q7BvJYidczCComUMrrJWm9Qgu hnOpFIK0rhwstI3UXny+khZao0q1gpqjaR6vlx1bdLFegN/AKDKgdVmJ1X//KaZR37 2QM04Q/xw/34+MGkqc/kScKRUy67BIgIw7fx3XG1ZAJoKoBj0pQGlaIPUZQdbNNqSP vtWfTtLpof5jfZyWbtoYz+/1yBHG13AOUsDCbmU2svdDLKSei0LvcfPMxItTRcWRP8 sb004nZtAJkHcfQdtovI+Rx2+7ziyGliSEP7rMJniziV3filmpqOwjX4OsJ6yD1IgJ g/07DP64sLTsg== Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3774.500.171.1.1\)) Subject: Re: Direct SSL connection with ALPN and HBA rules From: Daniel Gustafsson In-Reply-To: <1a717f65-7390-4111-8efd-c6e9b213805e@iki.fi> Date: Tue, 30 Apr 2024 12:10:38 +0200 Cc: Jacob Champion , Robert Haas , Michael Paquier , Postgres hackers Content-Transfer-Encoding: quoted-printable Message-Id: References: <5a79ed71-b365-4b20-80bc-9c2bf97bf84b@iki.fi> <3a6f126c-e1aa-4dcc-9252-9868308f6cf0@iki.fi> <1a717f65-7390-4111-8efd-c6e9b213805e@iki.fi> To: Heikki Linnakangas X-Mailer: Apple Mail (2.3774.500.171.1.1) List-Id: List-Help: List-Subscribe: List-Post: List-Owner: List-Archive: Archived-At: Precedence: bulk > On 29 Apr 2024, at 21:06, Heikki Linnakangas wrote: > Oh I was not aware sslrootcert=3Dsystem works like that. That's a bit = surprising, none of the other ssl-related settings imply or require that = SSL is actually used. Did we intend to set a precedence for new settings = with that? It was very much intentional, and documented, an sslmode other than = verify-full makes little sense when combined with sslrootcert=3Dsystem. It wasn't = intended to set a precedence (though there is probably a fair bit of things we = can do, getting this right is hard enough as it is), rather it was footgun = prevention. -- Daniel Gustafsson