Skip to content

Commit

Permalink
Browse files Browse the repository at this point in the history
This is a fix for:
pgbouncer/pgbouncer#713

The issue was pretty simple: the CSR was lacking a filled DN section. 
This was tracked down by reverse-engineering the communication done by
Postgres (which works with DataStudio/Looker without any issues) and
Postgres via pgbouncer.
After comparing packets sent on the handshake to DataStudio/Looker by
those two, I was able to provide a small fix resolving the linked issue.
  • Loading branch information
JacekSeligaOxla authored Apr 29, 2024
1 parent 7a22315 commit f6bab04
Showing 1 changed file with 4 additions and 0 deletions.
4 changes: 4 additions & 0 deletions usual/tls/tls_server.c
Original file line number Diff line number Diff line change
Expand Up @@ -56,6 +56,7 @@ int
tls_configure_server(struct tls *ctx)
{
EC_KEY *ecdh_key;
STACK_OF(X509_NAME) * cert_stack;
unsigned char sid[SSL_MAX_SSL_SESSION_ID_LENGTH];

if ((ctx->ssl_ctx = SSL_CTX_new(SSLv23_server_method())) == NULL) {
Expand Down Expand Up @@ -114,6 +115,9 @@ tls_configure_server(struct tls *ctx)
goto err;
}

cert_stack = SSL_load_client_CA_file(ctx->config->ca_file);
SSL_CTX_set_client_CA_list(ctx->ssl_ctx, cert_stack);

return (0);

err:
Expand Down

0 comments on commit f6bab04

Please sign in to comment.