Re: "cert" + clientcert=verify-ca in pg_hba.conf? - Mailing list pgsql-hackers

From Tom Lane
Subject Re: "cert" + clientcert=verify-ca in pg_hba.conf?
Date
Msg-id 1819158.1600999190@sss.pgh.pa.us
Whole thread Raw
In response to Re: "cert" + clientcert=verify-ca in pg_hba.conf?  (Kyotaro Horiguchi <horikyota.ntt@gmail.com>)
List pgsql-hackers
Kyotaro Horiguchi <horikyota.ntt@gmail.com> writes:
> Thank you Bruce, Michael. This is a rebased version.

I really strongly object to all the encoded data in this patch.
One cannot read it, one cannot even easily figure out how long
it is until the tests break by virtue of the certificates expiring.

One can, however, be entirely certain that they *will* break at
some point.  I don't like the idea of time bombs in our test suite.
That being the case, it'd likely be better to drop all the pre-made
certificates and have the test scripts create them on the fly.
That'd remove both the documentation problem (i.e., having readable
info as to how the certificates were made) and the expiration problem.

            regards, tom lane



pgsql-hackers by date:

Previous
From: Dilip Kumar
Date:
Subject: Re: Logical replication from PG v13 and below to PG v14 (devel version) is not working.
Next
From: Michael Paquier
Date:
Subject: Re: fixing old_snapshot_threshold's time->xid mapping