"Saleem Edah-Tally" <nmset@netcourrier.com> writes:
> I would have been more at ease if libpq could manage a PKCS12 cert. or some
> secure wallet/keystore that contains both the public and private keys for SSL
> traffic. Neither the end user nor any admin would have to provide the password
> to access the keys inside the secured storage as I would have prefered to
> hard-code the password. Hard coding is not an elegant solution I agree, but
> leaving on the table an unencrypted private key is not something to do IMO.
You realize, of course, that there is absolutely no way you can stop the
user from extracting whatever data you put on his machine. "Secure
wallet" is an exercise in self-delusion. If you want actual security,
there had better be a machine that *you* control in the way.
regards, tom lane