Re: "cert" + clientcert=verify-ca in pg_hba.conf?

Поиск
Список
Период
Сортировка
От Tom Lane
Тема Re: "cert" + clientcert=verify-ca in pg_hba.conf?
Дата
Msg-id 1819158.1600999190@sss.pgh.pa.us
обсуждение исходный текст
Ответ на Re: "cert" + clientcert=verify-ca in pg_hba.conf?  (Kyotaro Horiguchi <horikyota.ntt@gmail.com>)
Список pgsql-hackers
Kyotaro Horiguchi <horikyota.ntt@gmail.com> writes:
> Thank you Bruce, Michael. This is a rebased version.

I really strongly object to all the encoded data in this patch.
One cannot read it, one cannot even easily figure out how long
it is until the tests break by virtue of the certificates expiring.

One can, however, be entirely certain that they *will* break at
some point.  I don't like the idea of time bombs in our test suite.
That being the case, it'd likely be better to drop all the pre-made
certificates and have the test scripts create them on the fly.
That'd remove both the documentation problem (i.e., having readable
info as to how the certificates were made) and the expiration problem.

            regards, tom lane



В списке pgsql-hackers по дате отправления:

Предыдущее
От: Dilip Kumar
Дата:
Сообщение: Re: Logical replication from PG v13 and below to PG v14 (devel version) is not working.
Следующее
От: Michael Paquier
Дата:
Сообщение: Re: fixing old_snapshot_threshold's time->xid mapping