On Mon, 6 Dec 2004, Andrew M wrote:
> I have implemented your earlier suggestion:
>
> sslfactory=org.postgresql.ssl.NonValidatingFactory
>
> and no error are generated, so I presume that the connection to the
> database is now ssl'd. So why bother going through the headache of
> creating a certificate if I can do it like mentioned above?
It leaves you open to man in the middle attacks. You are no longer
verifying that the server is who they say they are.
Kris Jurka
