Re: [PATCH] Add `verify-system` sslmode to use system CA pool for server cert - Mailing list pgsql-hackers

From Daniel Gustafsson
Subject Re: [PATCH] Add `verify-system` sslmode to use system CA pool for server cert
Date
Msg-id 04BE1899-A3FD-4F5D-BAEE-C5C7EAA2848C@yesql.se
Whole thread Raw
In response to Re: [PATCH] Add `verify-system` sslmode to use system CA pool for server cert  (Tom Lane <tgl@sss.pgh.pa.us>)
Responses Re: [PATCH] Add `verify-system` sslmode to use system CA pool for server cert  (Daniel Gustafsson <daniel@yesql.se>)
List pgsql-hackers

> On 14 Apr 2023, at 15:51, Tom Lane <tgl@sss.pgh.pa.us> wrote:
>
> Daniel Gustafsson <daniel@yesql.se> writes:
>> I mainly put save_errno back into SOCK_ERRNO for greppability, I don't have any
>> strong opinions either way so I went with the latter suggestion.  Attached v3
>> does the above change and passes the tests both with a broken and working
>> system CA pool.  Unless objections from those with failing local envs I propose
>> this is pushed to close the open item.
>
> One more question when looking at it with fresh eyes: should the argument
> of X509_verify_cert_error_string be "ecode" or "vcode"?

Good catch, it should be vcode.

--
Daniel Gustafsson





pgsql-hackers by date:

Previous
From: Greg Stark
Date:
Subject: Re: Temporary tables versus wraparound... again
Next
From: Daniel Gustafsson
Date:
Subject: Re: [PATCH] Add `verify-system` sslmode to use system CA pool for server cert