| From: | Jacob Champion <jchampion(at)timescale(dot)com> |
|---|---|
| To: | Daniel Gustafsson <daniel(at)yesql(dot)se> |
| Cc: | Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us>, Peter Eisentraut <peter(dot)eisentraut(at)enterprisedb(dot)com>, "Gregory Stark (as CFM)" <stark(dot)cfm(at)gmail(dot)com>, PostgreSQL Hackers <pgsql-hackers(at)postgresql(dot)org>, Magnus Hagander <magnus(at)hagander(dot)net>, Michael Paquier <michael(at)paquier(dot)xyz>, thomas(at)habets(dot)se, Bruce Momjian <bruce(at)momjian(dot)us>, Andrew Dunstan <andrew(at)dunslane(dot)net>, Jelte Fennema <postgres(at)jeltef(dot)nl> |
| Subject: | Re: [PATCH] Add `verify-system` sslmode to use system CA pool for server cert |
| Date: | 2023-04-17 16:20:37 |
| Message-ID: | CAAWbhmgYfpoJ1OReOBvFjrk9ztA6dNtSE8V22UnTwQtn_+byeg@mail.gmail.com |
| Views: | Raw Message | Whole Thread | Download mbox | Resend email |
| Thread: | |
| Lists: | pgsql-hackers |
On Fri, Apr 14, 2023 at 3:36 PM Daniel Gustafsson <daniel(at)yesql(dot)se> wrote:
> This "error: Success" error has been reported to the list numerous times as
> misleading, and I'd love to make progress on improving error reporting during
> the v17 cycle.
Agreed!
> The attached checks for the specific known error, and leave all the other cases
> to the same logging that we have today. It relies on the knowledge that system
> sslrootcert configs has deferred loading, and will run with verify-full. So if
> we see an X509 failure in loading the local issuer cert here then we know the
> the user wanted to use the system CA pool for certificate verification but the
> root CA cannot be loaded for some reason.
This LGTM; I agree with your reasoning. Note that it won't fix the
(completely different) misleading error message for OpenSSL 3.0, but
since that's an *actively* unhelpful error message coming back from
OpenSSL, I don't think we want to override it. For 3.1, we have no
information and we're trying to fill in the gaps.
--Jacob
| From | Date | Subject | |
|---|---|---|---|
| Next Message | Corey Huinker | 2023-04-17 17:01:37 | Re: Note new NULLS NOT DISTINCT on unique index tutorial page |
| Previous Message | Nathan Bossart | 2023-04-17 16:19:14 | Re: recovery modules |