Re: [HACKERS] SSL Support

2004-09-21 Thread Dominic Mitchell
Tom Lane wrote: [EMAIL PROTECTED] (Dominic Mitchell) writes: On Tue, Sep 21, 2004 at 10:17:51AM +0200, Peter Eisentraut wrote: Am Dienstag, 21. September 2004 09:24 schrieb Dominic Mitchell: In initialize_SSL(), we call SSL_CTX_set_verify(), but we don't pass in the SSL_VERIFY_FAIL_IF_NO_PEER_CERT

Re: [HACKERS] SSL Support

2004-09-21 Thread Tom Lane
[EMAIL PROTECTED] (Dominic Mitchell) writes: > On Tue, Sep 21, 2004 at 10:17:51AM +0200, Peter Eisentraut wrote: >> Am Dienstag, 21. September 2004 09:24 schrieb Dominic Mitchell: >>> In initialize_SSL(), we call SSL_CTX_set_verify(), but we don't pass >>> in the SSL_VERIFY_FAIL_IF_NO_PEER_CERT fla

Re: [HACKERS] SSL Support

2004-09-21 Thread Alvaro Herrera
On Tue, Sep 21, 2004 at 10:35:56AM +0100, Dominic Mitchell wrote: > I think it's misleading to talk about SSL being supported without these > options. I've used SSL in other places (apache/mod_ssl, curl, stunnel) > and I came to expect this sort of verification as standard behaviour. > What's mor

Re: [HACKERS] SSL Support

2004-09-21 Thread Dominic Mitchell
On Tue, Sep 21, 2004 at 10:44:22AM +0200, Kaare Rasmussen wrote: > > I think verification of the server certificates is not supported either. > > SSL only serves for encryption, not authentication or integrity checking > > (which is probably a stupid idea). > > I have this feeling that SSL in Pos

Re: [HACKERS] SSL Support

2004-09-21 Thread Dominic Mitchell
On Tue, Sep 21, 2004 at 10:17:51AM +0200, Peter Eisentraut wrote: > Am Dienstag, 21. September 2004 09:24 schrieb Dominic Mitchell: > > I am also unsure of the > > procedures for submitting patches; is it ok to just send to hackers? > > [EMAIL PROTECTED] Thanks, I'll send it along there. > > I

Re: [HACKERS] SSL Support

2004-09-21 Thread Kaare Rasmussen
Hi > I think verification of the server certificates is not supported either. > SSL only serves for encryption, not authentication or integrity checking > (which is probably a stupid idea). I have this feeling that SSL in PostgreSQL isn't category 1 supported if you can put it that way. Maybe I

Re: [HACKERS] SSL Support

2004-09-21 Thread Peter Eisentraut
Am Dienstag, 21. September 2004 09:24 schrieb Dominic Mitchell: > I am also unsure of the > procedures for submitting patches; is it ok to just send to hackers? [EMAIL PROTECTED] > In initialize_SSL(), we call SSL_CTX_set_verify(), but we don't pass > in the SSL_VERIFY_FAIL_IF_NO_PEER_CERT fl