On Thu, Jul 14, 2016 at 11:27 PM, Tom Lane <tgl@sss.pgh.pa.us> wrote:
Greg Stark <stark@mit.edu> writes: > Well what's required to "configure SSL" anyways? If you don't have > verify-ca set or a root canal cert present then the server just needs a > certificate -- any certificate. Can the server just cons one up on demand > (or server startup or initdb)?
Hmm, good old "snake oil certificate" approach. Yeah, we could probably have initdb create a cert all the time. I had memories of this taking an undue amount of time, but it seems pretty fast on a modern server.
It can still take a very significant amount of time in some virtual environments, due to lack of entropy. And virtual environments aren't exactly uncommon these days...
Also, we could offer a switch to turn it off if necessary, with the understanding that non-Unix-socket connections can be expected to fail if user doesn't install a cert.
If we do it we should also ensure it's not enabled on localhost by default. Though that's a nice "consultant switch" -- more than once just turning that off (since it's on by default on debian/ubuntu) has fixed a customers entire performance issue and I could go back home again...