database/postgres
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2025-07-30 11:03:19 +03:00
Code Activity

Note that sslmode=require verifies the CA if root cert is present

Browse Source 
This mode still exists for backwards compatibility, making
sslmode=require the same as sslmode=verify-ca when the file is present,
but not causing an error when it isn't.

Per bug 6189, reported by Srinivas Aji
This commit is contained in:
Magnus Hagander
2011-09-24 14:29:37 +02:00
parent d1d7560861
commit 3e17a0020b
1 changed files with 15 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
doc/src/sgml/libpq.sgml
View File

@ -304,7 +304,9 @@
<row> <row>
<entry><literal>require</></entry> <entry><literal>require</></entry>
<entry>only try an <acronym>SSL</> connection</entry> <entry>only try an <acronym>SSL</> connection. If a root CA
file is present, verify the certificate in the same way as
if <literal>verify-ca</literal> was specified</entry>
</row> </row>
<row> <row>
@ -6197,6 +6199,18 @@ myEventProc(PGEventId evtId, void *evtInfo, void *passThrough)
by the connection parameters <literal>sslrootcert</> and <literal>sslcrl</> by the connection parameters <literal>sslrootcert</> and <literal>sslcrl</>
or the environment variables <envar>PGSSLROOTCERT</> and <envar>PGSSLCRL</>. or the environment variables <envar>PGSSLROOTCERT</> and <envar>PGSSLCRL</>.
</para> </para>
<note>
<para>
For backwards compatibility with earlier versions of PostgreSQL, if a
root CA file exists, the behavior of
<literal>sslmode</literal>=<literal>require</literal> will be the same
as that of <literal>verify-ca</literal>, meaning the sever certificate
is validated against the CA. Relying on this behavior is discouraged,
and applications that need certificate validation should always use
<literal>validate-ca</literal> or <literal>validate-full</literal>.
</para>
</note>
</sect2> </sect2>
<sect2 id="libpq-ssl-clientcert"> <sect2 id="libpq-ssl-clientcert">