Magnus Hagander wrote: > Martijn van Oosterhout wrote: > > On Sat, Dec 29, 2007 at 12:40:24PM +0100, Magnus Hagander wrote: > >> We already *do* allow the DBA to choose this, no? If you put the root > >> certificate on the client, it *will* verify the server cert, and it > >> *will* refuse to connect to a server that can't present a trusted root > >> cert. > > > > I think Tom's point is that we don't allow this for connections over a > > Unix Domain socket. And thus we should remove the asymmetry so the > > verification can work for them also. > > If that's where we still are, then I'm all for that provided it doesn't > add a whole lot of complexity, as I think I said before. I thought we > were now talking general SSL connections. That could be where I lost the > thread :-)
I think the user-visible impact of that addition would be to add 'localssl' in pg_hba.conf. It would be nice if we had made SSL control separate from the connection type, and perhaps we will explore that in 8.4. (None of this is 8.3, I believe.) -- Bruce Momjian <[EMAIL PROTECTED]> http://momjian.us EnterpriseDB http://postgres.enterprisedb.com + If your life is a hard drive, Christ can be your backup. + ---------------------------(end of broadcast)--------------------------- TIP 6: explain analyze is your friend
