From: Jacob Champion <pchampion@vmware.com>
To: peter.eisentraut@enterprisedb.com <peter.eisentraut@enterprisedb.com>
To: pgsql-hackers@postgresql.org <pgsql-hackers@postgresql.org>
Subject: Re: SSL SNI
Date: Thu, 25 Feb 2021 18:36:22 +0000
Message-ID: <ecb6a57d176a396feb959fbb0c53b3c794e8d8e5.camel@vmware.com> (raw)
In-Reply-To: <9407b344-7342-b2b7-004f-d5250687be42@enterprisedb.com>
References: <7289d5eb-62a5-a732-c3b9-438cee2cb709@enterprisedb.com>
<ef3d4b460ae7da59a8811f4e8e8fde0cd38a6cc8.camel@vmware.com>
<9407b344-7342-b2b7-004f-d5250687be42@enterprisedb.com>
On Thu, 2021-02-25 at 17:00 +0100, Peter Eisentraut wrote:
> Just as additional data points, it has come to my attention that both
> the Go driver ("lib/pq") and the JDBC environment already send SNI
> automatically. (In the case of JDBC this is done by the Java system
> libraries, not the JDBC driver implementation.)
For the Go case it's only for sslmode=verify-full, and only because the
Go standard library implementation does it for you automatically if you
request the builtin server hostname validation. (I checked both lib/pq
and its de facto replacement, jackc/pgx.) So it may not be something
that was done on purpose by the driver implementation.
--Jacob
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: pchampion@vmware.com, peter.eisentraut@enterprisedb.com
Subject: Re: SSL SNI
In-Reply-To: <ecb6a57d176a396feb959fbb0c53b3c794e8d8e5.camel@vmware.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox