The attached rebase brings a few more tests by Jacob for ensuring that a) CA's entirely replace when a host config is matched; b) that CRL's work as intended for certificates configured in pg_hosts.conf; and c) ssl_sni and TLS init aren't configured at the same time.
This concludes all TODOs in the code, unless there are review objections I plan to go ahead with this version within a few days. -- Daniel Gustafsson
v19-0002-ssl-Serverside-SNI-support-for-libpq.patch
Description: Binary data
v19-0001-ssl-Add-tests-for-client-CA.patch
Description: Binary data
