From: | Greg Stark <stark(at)mit(dot)edu> |
---|---|
To: | Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us> |
Cc: | Andrew Dunstan <andrew(at)dunslane(dot)net>, thomas(at)habets(dot)se, PostgreSQL-development <pgsql-hackers(at)postgresql(dot)org> |
Subject: | Re: [PATCH] Add `verify-system` sslmode to use system CA pool for server cert |
Date: | 2021-09-17 21:35:58 |
Message-ID: | CAM-w4HO3JAvoZb9LtemyYStuVvGLuF9_HDG9cdU1mq=bZ4UGfg@mail.gmail.com |
Views: | Raw Message | Whole Thread | Download mbox | Resend email |
Thread: | |
Lists: | pgsql-hackers |
Hm. Let's Encrypt's FAQ tells me I'm on the right track with that
question but the distinctinos are far more coarse than I was worried
about:
Does Let’s Encrypt issue certificates for anything other than SSL/TLS
for websites?
Let’s Encrypt certificates are standard Domain Validation
certificates, so you can use them for any server that uses a domain
name, like web servers, mail servers, FTP servers, and many more.
Email encryption and code signing require a different type of
certificate that Let’s Encrypt does not issue.
So it sounds like, at least for SSL connections, we should use the
same certificate authorities used to authenticate web sites. If ever
we implemented signed extensions, for example, it might require
different certificates -- I don't know what that means for the SSL
validation rules and the storage for them.
From | Date | Subject | |
---|---|---|---|
Next Message | Alvaro Herrera | 2021-09-17 21:59:24 | Re: Timeout failure in 019_replslot_limit.pl |
Previous Message | Alvaro Herrera | 2021-09-17 21:22:00 | Re: prevent immature WAL streaming |