database/postgres
database/postgres
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2025-05-05 09:19:17 +03:00
Code

doc: Clarify the system value for sslrootcert

Browse Source 
The documentation for the special value "system" for sslrootcert could
be misinterpreted to mean the default operating system CA store, which
it may be, but it's defined to be the default CA store of the SSL lib
used.

Backpatch down to v16 where support for the system value was added.

Author: Daniel Gustafsson <daniel@yesql.se>
Reviewed-by: George MacKerron <george@mackerron.co.uk>
Discussion: https://postgr.es/m/B3CBBAA3-6EA3-4AB7-8619-4BBFAB93DDB4@yesql.se
Backpatch-through: 16
This commit is contained in:
Daniel Gustafsson 2025-04-04 09:47:36 +02:00
parent aab422af95
commit c88b36d382
2 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
doc/src/sgml/libpq.sgml
View File

@ -1999,7 +1999,7 @@ postgresql://%2Fvar%2Flib%2Fpostgresql/dbname
</para>
<para>
The special value <literal>system</literal> may be specified instead, in
which case the system's trusted CA roots will be loaded. The exact
which case the trusted CA roots from the SSL implementation will be loaded. The exact
locations of these root certificates differ by SSL implementation and
platform. For <productname>OpenSSL</productname> in particular, the
locations may be further modified by the <envar>SSL_CERT_DIR</envar>

3
doc/src/sgml/runtime.sgml
View File

@ -1986,7 +1986,8 @@ pg_dumpall -p 5432 | psql -d postgres -p 5433
<literal>sslmode=verify-ca</literal> or
<literal>verify-full</literal> and have the appropriate root certificate
file installed (<xref linkend="libq-ssl-certificates"/>). Alternatively the
system CA pool can be used using <literal>sslrootcert=system</literal>; in
<link linkend="libpq-connect-sslrootcert">system CA pool</link>, as defined
by the SSL implementation, can be used using <literal>sslrootcert=system</literal>; in
this case, <literal>sslmode=verify-full</literal> is forced for safety, since
it is generally trivial to obtain certificates which are signed by a public
CA.