On 2022-10-25 Tu 07:01, tho...@habets.se wrote: > On Tue, 25 Oct 2022 01:03:23 +0100, Jacob Champion > <jchamp...@timescale.com> said: >> I'd like to try to get this conversation started again. To pique >> interest I've attached a new version of 0001, which implements >> `sslrootcert=system` instead as suggested upthread. In 0002 I went >> further and switched the default sslmode to `verify-full` when using >> the system CA roots, because I feel pretty strongly that anyone >> interested in using public CA systems is also interested in verifying >> hostnames. (Otherwise, why make the switch?) > Yeah I agree that not forcing verify-full when using system CAs is a > giant foot-gun, and many will stop configuring just until it works. > > Is there any argument for not checking hostname when using a CA pool > for which literally anyone can create a cert that passes? > > It makes sense for self-signed, or "don't care", since that provides > at least protection against passive attacks, but if someone went out > of their way to get a third party signed cert, then it doesn't. > > One downside to this approach is that now one option will change the > value of another option. For SSL mode (my rejected patch :-) ) that > makes maybe some more sense. > > For users, what is more surprising: A foot-gun that sounds safe, or > one option that overrides another?
I don't find too much difficulty in having one option's default depend on another's value, as long as it's documented. cheers andrew -- Andrew Dunstan EDB: https://www.enterprisedb.com
