database/postgres
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2025-07-27 12:41:57 +03:00
Code Activity

Allow to use system CA pool for certificate verification

Browse Source 
This adds a new option to libpq's sslrootcert, "system", which will load
the system trusted CA roots for certificate verification. This is a more
convenient way to achieve this than pointing to the system CA roots
manually since the location can differ by installation and be locally
adjusted by env vars in OpenSSL.

When sslrootcert is set to system, sslmode is forced to be verify-full
as weaker modes aren't providing much security for public CAs.

Changing the location of the system roots by setting environment vars is
not supported by LibreSSL so the tests will use a heuristic to determine
if the system being tested is LibreSSL or OpenSSL.

The workaround in .cirrus.yml is required to handle a strange interaction
between homebrew and the openssl@3 formula; hopefully this can be removed
in the near future.

The original patch was written by Thomas Habets, which was later revived
by Jacob Champion.

Author: Jacob Champion <jchampion@timescale.com>
Author: Thomas Habets <thomas@habets.se>
Reviewed-by: Jelte Fennema <postgres@jeltef.nl>
Reviewed-by: Andrew Dunstan <andrew@dunslane.net>
Reviewed-by: Magnus Hagander <magnus@hagander.net>
Discussion: https://www.postgresql.org/message-id/flat/CA%2BkHd%2BcJwCUxVb-Gj_0ptr3_KZPwi3%2B67vK6HnLFBK9MzuYrLA%40mail.gmail.com
This commit is contained in:
Daniel Gustafsson
2023-04-05 23:22:17 +02:00
parent 12f3867f55
commit 8eda731465
9 changed files with 247 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
doc/src/sgml/libpq.sgml
View File

@ -1876,6 +1876,30 @@ postgresql://%2Fvar%2Flib%2Fpostgresql/dbname
to be signed by one of these authorities. The default is
<filename>~/.postgresql/root.crt</filename>.
</para>
<para>
The special value <literal>system</literal> may be specified instead, in
which case the system's trusted CA roots will be loaded. The exact
locations of these root certificates differ by SSL implementation and
platform. For <productname>OpenSSL</productname> in particular, the
locations may be further modified by the <envar>SSL_CERT_DIR</envar>
and <envar>SSL_CERT_FILE</envar> environment variables.
</para>
<note>
<para>
When using <literal>sslrootcert=system</literal>, the default
<literal>sslmode</literal> is changed to <literal>verify-full</literal>,
and any weaker setting will result in an error. In most cases it is
trivial for anyone to obtain a certificate trusted by the system for a
hostname they control, rendering <literal>verify-ca</literal> and all
weaker modes useless.
</para>
<para>
The magic <literal>system</literal> value will take precedence over a
local certificate file with the same name. If for some reason you find
yourself in this situation, use an alternative path like
<literal>sslrootcert=./system</literal> instead.
</para>
</note>
</listitem>
</varlistentry>

6
doc/src/sgml/runtime.sgml
View File

@ -2007,7 +2007,11 @@ pg_dumpall -p 5432 | psql -d postgres -p 5433
(<xref linkend="ssl-tcp"/>). The TCP client must connect using
<literal>sslmode=verify-ca</literal> or
<literal>verify-full</literal> and have the appropriate root certificate
file installed (<xref linkend="libq-ssl-certificates"/>).
file installed (<xref linkend="libq-ssl-certificates"/>). Alternatively the
system CA pool can be used using <literal>sslrootcert=system</literal>; in
this case, <literal>sslmode=verify-full</literal> is forced for safety, since
it is generally trivial to obtain certificates which are signed by a public
CA.
</para>
<para>