ssl: Don't disable SSL for all hosts when one SNI host fails to load On Windows and in EXEC_BACKEND builds every backend reloads the SSL configuration, with no previous one to fall back on. If a single pg_hosts.conf entry failed to load there, the whole configuration was discarded and the backend ran without SSL for every host. Fix by keeping the failed entry without an SSL context in child processes and failing the handshake only for connections selecting it.
Also document that SSL_passphrase_cmd_reload must be enabled on Windows, like commit 0f4f45772c5 did for the GUC. Author: Zsolt Parragi <[email protected]> Reviewed-by: Daniel Gustafsson <[email protected]> Discussion: https://postgr.es/m/CAN4CZFM-Hn7-bdKC8=xwCQiE128Y1Xao+aft=grq5qa9okz...@mail.gmail.com Backpatch-through: 19 Branch ------ REL_19_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/9674c91aeb2abbdf3a73f833b3f5ad7e87c5fe77 Modified Files -------------- doc/src/sgml/runtime.sgml | 10 ++++++++++ src/backend/libpq/be-secure-openssl.c | 24 +++++++++++++++++++++++- src/test/ssl/t/004_sni.pl | 32 ++++++++++++++++++++++++++++++++ 3 files changed, 65 insertions(+), 1 deletion(-)
