Re: BUG #4340: SECURITY: Is SSL Doing Anything?

Tom Lane wrote:
> "Dan Kaminsky" <dan@doxpara.com> writes:
>
>> Clearly, this is handling self-signed certs.  Great.  But what I really want
>> to know is, is verify_peer accepting a self-signed identity assertion?
>> Because that'd be remote EoP.
>>
>
> I'm just guessing what you're driving at (unexplained acronyms aren't
> a good way to communicate), but I think it's not a big problem.  PG
> doesn't rely on SSL for authentication, only for communications
> security, so whether the remote cert is self-signed doesn't seem
> like much of an issue.  Anyway, you can adjust your list of trusted
> CAs to determine whether you'll accept it or not.
>
>             regards, tom lane
>
Heh Tom,

    Thanks for replying so quickly.  It's definitely appreciated.

    Apologies, EoP = Escalation of Privilege.  I've been up all night.

    Lets talk about the verify_cb callback first:  Suppose there's a
man-in-the-middle between the PG client and the PG server.  Is some
secondary force going to apply some Trusted CA list?

    Second, are you saying verify_peer doesn't do anything for
authentication?  Are you sure about that?  There's really little reason
otherwise for the call to exist.

--Dan