Re: what can go in root.crt ?

Chapman Flack <chap@anastigmatix.net> writes:
> On 06/04/20 17:31, Andrew Dunstan wrote:
>> Do we actually do any of this sort of thing? I confess my impression was
>> this is all handled by the openssl libraries, we just hand over the
>> certs and let openssl do its thing. Am I misinformed about that?

> By analogy to other SSL libraries I have worked with, my guess would
> be that there are certain settings and callbacks available that would
> determine some of what it is doing.

It's possible that we could force openssl to validate cases it doesn't
accept now.  Whether we *should* deviate from its standard behavior is
a fairly debatable question though.  I would not be inclined to do so
unless we find that many other consumers of the library also do that.
Overriding a library in its specific area of expertise seems like a
good way to get your fingers burnt.

            regards, tom lane