> On 24 Aug 2026, at 17:34, Михаил Купцов <[email protected]> wrote:
> I would like to propose a different approach regarding the client side > behavior > in terms of working with the list of revoked certificates. The problem that > was discovered is that if a user, using psql, accidentally specifies an > incorrect path to a crl file or crl directory, the client part of Postgres > ignores the user's error and connects the client to the database whose > certificate the client would, in theory, want to check whether the database > server certificate has been revoked. I'm sympathetic to the idea of helping the user detect misconfiguration. However, I wonder how common it is to have a "local default" filename configured in apps which may or may not be present. If those users all of a sudden cannot connect after an upgrade then we didn't really improve anything. Also, with this patch, users who have placed their CRL to match the default CRL file location (~/.postgresql/root.crl) won't get an error if that file is missing even if their intention was to use that file. I think a stricter CRL policy would need another trigger. -- Daniel Gustafsson
