> On 3 Dec 2025, at 22:27, Jelte Fennema-Nio <[email protected]> wrote: > > On Wed, 3 Dec 2025 at 17:57, Heikki Linnakangas <[email protected]> wrote: >>> I really want to make it possible for anyone who don't want SNI to keep >>> using >>> postgresql.conf and get the exact behavior they've always had. Do you agree >>> with that design goal? >> >> Yeah, that's fair. > > What if we make it so that if a pg_hosts.conf file exists, then the > ssl_cert_file/ssl_key_file configs are ignored? And by default initdb > would not create a file (or it would, but with the same default > settings that we have now).
Maybe. I'm not a big fan of magic-file-exist configurations but.. I'm trying out a few different options to see which seems the most reasonable, and this is for one of them. > Basically it would be: > 1. If the file does not exist, use the "off" behaviour > 2. If the file exists, use the "strict" behaviour It will really be "strict" *or* "default" based on whether or not '*' is set as a wildcard hostname (which can be argued is just a version of strict). -- Daniel Gustafsson
