On Thu, Jul 14, 2016 at 11:27 PM, Tom Lane <t...@sss.pgh.pa.us> wrote:

> Greg Stark <st...@mit.edu> writes:
> > Well what's required to "configure SSL" anyways? If you don't have
> > verify-ca set or a root canal cert present then the server just needs a
> > certificate -- any certificate. Can the server just cons one up on demand
> > (or server startup or initdb)?
> Hmm, good old "snake oil certificate" approach.  Yeah, we could probably
> have initdb create a cert all the time.  I had memories of this taking
> an undue amount of time, but it seems pretty fast on a modern server.

It can still take a very significant amount of time in some virtual
environments, due to lack of entropy. And virtual environments aren't
exactly uncommon these days...

> Also, we could offer a switch to turn it off if necessary, with the
> understanding that non-Unix-socket connections can be expected to fail
> if user doesn't install a cert.

If we do it we should also ensure it's not enabled on localhost by default.
Though that's a nice "consultant switch" -- more than once just turning
that off (since it's on by default on debian/ubuntu) has fixed a customers
entire performance issue and I could go back home again...

 Magnus Hagander
 Me: http://www.hagander.net/
 Work: http://www.redpill-linpro.com/

Reply via email to