<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">Hi,<div class=""><br class=""></div><div class="">Fixed in <a href="http://trac.calendarserver.org/changeset/15710/CalendarServer/trunk" class="">http://trac.calendarserver.org/changeset/15710/CalendarServer/trunk</a></div><div class=""><br class=""></div><div class="">Because pg8000 has a separate kwarg to enable SSL, and because Twisted / endpoints don't have to do anything differently for an SSL connection via pg8000 to succeed, I went with a separate 'ssl' option for the DB config dict instead of adding support for a 'tcps' prefix.</div><div class=""><br class=""></div><div class="">Although the pg8000 documentation doesn't state this explicitly, testing shows that enabling this option *<a href="http://trac.calendarserver.org/changeset/15714/CalendarServer/trunk" class="">requires</a>* SSL, and does not merely use SSL if available. The connection will fail if SSL is not available.</div><div class=""><br class=""></div><div class="">-dre</div><div class=""><br class=""><div><blockquote type="cite" class=""><div class="">On Jun 24, 2016, at 3:50 PM, Andre LaBranche <<a href="mailto:dre@apple.com" class="">dre@apple.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class="">Rebuilding PG with openssl support wasn't that hard. Turns out I already had openssl installed via brew, so just needed to define a couple env vars.<br class=""><br class=""><blockquote type="cite" class="">I tried the most naive thing I could think of,<br class=""></blockquote><br class="">... no it's not that simple. Also because that patch is bunk, as the string slice is off by one, so fails to capture the entire hostname when there is a tcps: prefix.<br class=""><br class=""><blockquote type="cite" class="">since I believe none of the parameters we pass down to pg8000 are TLS-aware<br class=""></blockquote><br class="">Yes, they are. The one called 'ssl' in pg8000/__init__.py which is a bool.<br class=""><br class="">After some reckless hacking, I got this to work, verified by the fact that my PG server is configured to allow only connections that use SSL. I'll clean this up and do some more testing before committing.<br class=""><br class="">-dre<br class="">_______________________________________________<br class="">calendarserver-dev mailing list<br class=""><a href="mailto:calendarserver-dev@lists.macosforge.org" class="">calendarserver-dev@lists.macosforge.org</a><br class="">https://lists.macosforge.org/mailman/listinfo/calendarserver-dev<br class=""></div></div></blockquote></div><br class=""></div></body></html>