Tom Lane wrote:
> "Dan Kaminsky" <dan@doxpara.com> writes:
>
>> Clearly, this is handling self-signed certs. Great. But what I really want
>> to know is, is verify_peer accepting a self-signed identity assertion?
>> Because that'd be remote EoP.
>>
>
> I'm just guessing what you're driving at (unexplained acronyms aren't
> a good way to communicate), but I think it's not a big problem. PG
> doesn't rely on SSL for authentication, only for communications
> security, so whether the remote cert is self-signed doesn't seem
> like much of an issue. Anyway, you can adjust your list of trusted
> CAs to determine whether you'll accept it or not.
>
> regards, tom lane
>
Heh Tom,
Thanks for replying so quickly. It's definitely appreciated.
Apologies, EoP = Escalation of Privilege. I've been up all night.
Lets talk about the verify_cb callback first: Suppose there's a
man-in-the-middle between the PG client and the PG server. Is some
secondary force going to apply some Trusted CA list?
Second, are you saying verify_peer doesn't do anything for
authentication? Are you sure about that? There's really little reason
otherwise for the call to exist.
--Dan
