hl-valdemar/dbdash
1
0
Fork 0
Code Issues Pull Requests Actions Packages Releases Wiki Activity

fix: accept RDS certificates without EKU using verified OpenSSL TLS

Browse Source
This commit is contained in:
Valdemar Lorenzen
2026-10-20 13:40:04 +02:00
parent 08afa1e495
commit 2aac7361d6
4 changed files with 152 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/main.rs
+3
View File
@@ -45,6 +45,9 @@ For CLI PostgreSQL connections, use --ca-bundle PATH before the connection strin
and specify sslmode=require. Unset PGSSLROOTCERT; legacy launchers are rejected
instead of silently losing their custom CA verification.
Only the selected bundle is trusted for that connection; system trust is unchanged.
Explicit CA bundles use OpenSSL verification for compatibility with RDS certificates
that omit Extended Key Usage; incompatible EKU, invalid chains, dates, and hostnames
are still rejected. System trust uses the native platform TLS verifier.
Certificates and hostnames are verified before authentication; no plaintext fallback
with a CA bundle. Missing, empty, or invalid selected files block connection.
Use a bundle from the trusted issuer, not an unverified server's certificate.