On Wed, Sep 7, 2022 at 10:03 AM Jacob Champion <jchamp...@timescale.com> wrote: > Yeah, that should be fine. Requiring newer OpenSSLs for stronger > crypto will probably be uncontroversial.
While looking into this I noticed that I left the following code in place: > #ifdef HAVE_BE_TLS_GET_CERTIFICATE_HASH > if (strcmp(selected_mech, SCRAM_SHA_256_PLUS_NAME) == 0 && > port->ssl_in_use) In other words, we're still deciding whether to advertise -PLUS based only on whether we support tls-server-end-point. Maybe all the necessary features landed in OpenSSL in the same version, but I haven't double-checked that, and in any case I think I need to make this code more correct in the next version of this patch. --Jacob
