You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

Michael Paquier 36f40ce2dc libpq: Add sslcertmode option to control client certificates ... The sslcertmode option controls whether the server is allowed and/or required to request a certificate from the client. There are three modes: - "allow" is the default and follows the current behavior, where a configured client certificate is sent if the server requests one (via one of its default locations or sslcert). With the current implementation, will happen whenever TLS is negotiated. - "disable" causes the client to refuse to send a client certificate even if sslcert is configured or if a client certificate is available in one of its default locations. - "require" causes the client to fail if a client certificate is never sent and the server opens a connection anyway. This doesn't add any additional security, since there is no guarantee that the server is validating the certificate correctly, but it may helpful to troubleshoot more complicated TLS setups. sslcertmode=require requires SSL_CTX_set_cert_cb(), available since OpenSSL 1.0.2. Note that LibreSSL does not include it. Using a connection parameter different than require_auth has come up as the simplest design because certificate authentication does not rely directly on any of the AUTH_REQ_* codes, and one may want to require a certificate to be sent in combination of a given authentication method, like SCRAM-SHA-256. TAP tests are added in src/test/ssl/, some of them relying on sslinfo to check if a certificate has been set. These are compatible across all the versions of OpenSSL supported on HEAD (currently down to 1.0.1). Author: Jacob Champion Reviewed-by: Aleksander Alekseev, Peter Eisentraut, David G. Johnston, Michael Paquier Discussion: https://postgr.es/m/9e5a8ccddb8355ea9fa4b75a1e3a9edc88a70cd3.camel@vmware.com		2 years ago
..
backend	meson: add install-{quiet, world} targets	2 years ago
bin	meson: add install-{quiet, world} targets	2 years ago
common	Implement find_my_exec()'s path normalization using realpath(3).	2 years ago
fe_utils	Revert refactoring of restore command code to shell_restore.c	2 years ago
include	libpq: Add sslcertmode option to control client certificates	2 years ago
interfaces	libpq: Add sslcertmode option to control client certificates	2 years ago
makefiles	meson: Make auto the default of the ssl option	2 years ago
pl	meson: add install-{quiet, world} targets	2 years ago
port	Use nanosleep() to implement pg_usleep().	2 years ago
template	Use unnamed POSIX semaphores on Cygwin.	3 years ago
test	libpq: Add sslcertmode option to control client certificates	2 years ago
timezone	Fix outdated references to guc.c	2 years ago
tools	libpq: Add sslcertmode option to control client certificates	2 years ago
tutorial	Remove useless casts to (void *) in arguments of some system functions	2 years ago
.gitignore	…
DEVELOPERS	…
Makefile	Integrate pg_bsd_indent into our build/test infrastructure.	2 years ago
Makefile.global.in	autoconf: Move export_dynamic determination to configure	3 years ago
Makefile.shlib	…
meson.build	Integrate pg_bsd_indent into our build/test infrastructure.	2 years ago
nls-global.mk	…