ssl: Don't disable SSL for all hosts when one SNI host fails to load On Windows and in EXEC_BACKEND builds every backend reloads the SSL configuration, with no previous one to fall back on. If a single pg_hosts.conf entry failed to load there, the whole configuration was discarded and the backend ran without SSL for every host. Fix by keeping the failed entry without an SSL context in child processes and failing the handshake only for connections selecting it.
Also document that SSL_passphrase_cmd_reload must be enabled on Windows, like commit 0f4f45772c5 did for the GUC. Author: Zsolt Parragi <[email protected]> Reviewed-by: Daniel Gustafsson <[email protected]> Discussion: https://postgr.es/m/CAN4CZFM-Hn7-bdKC8=xwCQiE128Y1Xao+aft=grq5qa9okz...@mail.gmail.com Backpatch-through: 19 Branch ------ master Details ------- https://git.postgresql.org/pg/commitdiff/07be6f384ca7a90c83055da46346e39a0b4d421d Modified Files -------------- doc/src/sgml/runtime.sgml | 10 ++++++++++ src/backend/libpq/be-secure-openssl.c | 24 +++++++++++++++++++++++- src/test/ssl/t/004_sni.pl | 32 ++++++++++++++++++++++++++++++++ 3 files changed, 65 insertions(+), 1 deletion(-)
