Re: sslmode=require fallback

Поиск
Список
Период
Сортировка
Искать
От
Andreas 'ads' Scherbaum
Тема
Re: sslmode=require fallback
Дата
Msg-id
5788A39F.5010703@wars-nicht.de
Ответ на
Re: sslmode=require fallback (Magnus Hagander)
Список
Дерево обсуждения
sslmode=require fallback Jakob Egger <jakob@eggerapps.at>
Re: sslmode=require fallback Magnus Hagander <magnus@hagander.net>
Re: sslmode=require fallback Bruce Momjian <bruce@momjian.us>
Re: sslmode=require fallback Magnus Hagander <magnus@hagander.net>
Re: sslmode=require fallback Robert Haas <robertmhaas@gmail.com>
Re: sslmode=require fallback Tom Lane <tgl@sss.pgh.pa.us>
Re: sslmode=require fallback Robert Haas <robertmhaas@gmail.com>
Re: sslmode=require fallback Tom Lane <tgl@sss.pgh.pa.us>
Re: sslmode=require fallback Peter Eisentraut <peter.eisentraut@2ndquadrant.com>
Re: sslmode=require fallback Magnus Hagander <magnus@hagander.net>
Re: sslmode=require fallback Tom Lane <tgl@sss.pgh.pa.us>
Re: sslmode=require fallback Andrew Dunstan <andrew@dunslane.net>
Re: sslmode=require fallback Peter Eisentraut <peter.eisentraut@2ndquadrant.com>
Re: sslmode=require fallback Christoph Berg <myon@debian.org>
Re: sslmode=require fallback Magnus Hagander <magnus@hagander.net>
Re: sslmode=require fallback Peter Eisentraut <peter.eisentraut@2ndquadrant.com>
Re: sslmode=require fallback Bruce Momjian <bruce@momjian.us>
Re: sslmode=require fallback Peter Eisentraut <peter.eisentraut@2ndquadrant.com>
Re: sslmode=require fallback Bruce Momjian <bruce@momjian.us>
Re: sslmode=require fallback Jeff Janes <jeff.janes@gmail.com>
Re: sslmode=require fallback Bruce Momjian <bruce@momjian.us>
Re: sslmode=require fallback Greg Stark <stark@mit.edu>
Re: sslmode=require fallback Magnus Hagander <magnus@hagander.net>
Re: sslmode=require fallback Peter Eisentraut <peter.eisentraut@2ndquadrant.com>
Re: sslmode=require fallback Magnus Hagander <magnus@hagander.net>
Re: sslmode=require fallback "Daniel Verite" <daniel@manitou-mail.org>
Re: sslmode=require fallback Peter Eisentraut <peter.eisentraut@2ndquadrant.com>
Re: sslmode=require fallback Greg Stark <stark@mit.edu>
Re: sslmode=require fallback Christoph Berg <cb@df7cb.de>
Re: sslmode=require fallback Magnus Hagander <magnus@hagander.net>
Re: sslmode=require fallback Peter Eisentraut <peter.eisentraut@2ndquadrant.com>
Re: sslmode=require fallback Robert Haas <robertmhaas@gmail.com> 
On 14.07.2016 23:34, Magnus Hagander wrote:
>
>
> On Thu, Jul 14, 2016 at 11:27 PM, Tom Lane  > wrote:
>
>     Greg Stark > writes:
>     > Well what's required to "configure SSL" anyways? If you don't have
>     > verify-ca set or a root canal cert present then the server just needs a
>     > certificate -- any certificate. Can the server just cons one up on demand
>     > (or server startup or initdb)?
>
>     Hmm, good old "snake oil certificate" approach.  Yeah, we could probably
>     have initdb create a cert all the time.  I had memories of this taking
>     an undue amount of time, but it seems pretty fast on a modern server.
>
>
> It can still take a very significant amount of time in some virtual
> environments, due to lack of entropy. And virtual environments aren't
> exactly uncommon these days...

What expire time would you chose for the certificate? One year? Two years?
Which tool is going to re-generate your new cert, once this one expires? 
You don't want to run initdb again ...


Regards,

-- 			Andreas 'ads' Scherbaum
German PostgreSQL User Group
European PostgreSQL User Group - Board of Directors
Volunteer Regional Contact, Germany - PostgreSQL Project
В списке pgsql-hackers по дате отправления
Предыдущее
От: Craig Ringer
Дата:
Следующее
От: Dmitriy Sarafannikov
Дата:
FAQ