On Thu, Jul 14, 2016 at 11:27 PM, Tom Lane <t...@sss.pgh.pa.us> wrote:
> Greg Stark <st...@mit.edu> writes: > > Well what's required to "configure SSL" anyways? If you don't have > > verify-ca set or a root canal cert present then the server just needs a > > certificate -- any certificate. Can the server just cons one up on demand > > (or server startup or initdb)? > > Hmm, good old "snake oil certificate" approach. Yeah, we could probably > have initdb create a cert all the time. I had memories of this taking > an undue amount of time, but it seems pretty fast on a modern server. > It can still take a very significant amount of time in some virtual environments, due to lack of entropy. And virtual environments aren't exactly uncommon these days... > Also, we could offer a switch to turn it off if necessary, with the > understanding that non-Unix-socket connections can be expected to fail > if user doesn't install a cert. > If we do it we should also ensure it's not enabled on localhost by default. Though that's a nice "consultant switch" -- more than once just turning that off (since it's on by default on debian/ubuntu) has fixed a customers entire performance issue and I could go back home again... -- Magnus Hagander Me: http://www.hagander.net/ Work: http://www.redpill-linpro.com/
