Re: Making sslrootcert=system work on Windows psql

> On 1 Apr 2025, at 23:46, Jacob Champion <jacob(dot)champion(at)enterprisedb(dot)com> wrote:
> On Tue, Apr 1, 2025 at 2:05 PM George MacKerron <george(at)mackerron(dot)co(dot)uk> wrote:

>> I’ve recently been trying to get it more widely supported, with some success (details at end of this message).
>
> (Thank you!)

+many

>> I’m not a Windows or OpenSSL expert, but so far the patched code seems to work in theory and in practice (sources below, and I’ve compiled and tested it working on Windows 11 x64).
>
> While this will get things working -- if you plan to use the Windows
> store! -- I worry that it's an incompatible change, and anyone who is
> actually happy with the way things currently work (i.e. not using the
> EDB installers) will be broken. The meaning of `sslrootcert=system` is
> "do whatever OpenSSL wants to do by default." That includes
> modification by the OpenSSL environment variables, which (I think)
> this patch disables.

Correct, this patch changes from using the defaults (directory, file and store)
and thus the env variable overrides, to hardcoding the new winstore which came
in 3.2 as the only option. While I agree that we probably should allow
winstore (and other such stores for other platforms when/if they happen) I
don't think making it the only option is the right way.

> The winstore is new to me. Is there no way to get OpenSSL to switch
> its default store without code changes?

AFAIK one cannot change the default store in OpenSSL short of recompiling
OpenSSL.

--
Daniel Gustafsson