Re: [BUGS] More SSL questions..
Tom Lane <[email protected]>
| Newsgroups | gmane.comp.db.postgresql.devel.win32,gmane.comp.db.postgresql.bugs |
|---|---|
| Message-ID | <[email protected]> |
Oliver Jowett <[email protected]> writes: > Tom Lane wrote: >> I'm not sure if this is desirable. Should libpq try to fall back to a >> non-SSL-encrypted connection, instead? > Only if the server certificate validates, otherwise an active attacker > could intercept the SSL connection to force libpq to fall back to > non-SSL and then intercept the unencrypted/unauthenticated connection. The problem case is where there are no SSL support files, and so the client isn't going to be able to validate the server cert anyway. So the above doesn't seem real helpful... Basically my point here is that the default "prefer" SSL mode effectively becomes "require" if the server has a root.crt. regards, tom lane ---------------------------(end of broadcast)--------------------------- TIP 9: the planner will ignore your desire to choose an index scan if your joining column's datatypes do not match