mir/kea
2
0
Fork 0
mirror of https://gitlab.isc.org/isc-projects/kea synced 2025-08-22 18:08:16 +00:00
Code Issues Releases Wiki Activity

[#4005] Added doc and ChangeLog entry

Browse Source
This commit is contained in:
Francis Dupont 2025-07-10 17:04:19 +02:00 committed by Razvan Becheriu
parent 88c7ccee0c
commit c28ec9c260
2 changed files with 17 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
changelog_unreleased/3927-add-tls-settings-to-pqconnectdb Normal file
View File

@ -0,0 +1,5 @@
[func] razvan
Added SSL/TLS support for PostgreSQL database connection in
the Kea configuration. Available parameters are:
"trust-anchor", "cert-file", "key-file" and "ssl-mode".
(Gitlab #3927)

12
doc/devel/unit-tests.dox
View File

@ -65,6 +65,11 @@ The following environment variable can affect the unit tests:
the environment of the unit test process is updated so usually this
variable is manually set only in order to enforce a particular status.
- KEA_PGSQL_HAVE_SSL - Specifies the SSL/TLS support status of PostgreSQL.
When not set the corresponding PostgreSQL global variable is read and
the environment of the unit test process is updated so usually this
variable is manually set only in order to enforce a particular status.
- KEA_PIDFILE_DIR - Specifies the directory which should be used for PID files
as used by dhcp::Daemon or its derivatives. If not specified, the
default is <i>prefix</i>/var/run/kea, where <i>prefix</i> defaults to
@ -228,6 +233,13 @@ mysql> SHOW GLOBAL VARIABLES LIKE 'have_ssl';
The value of this MySQL global variable is reflected by the
KEA_MYSQL_HAVE_SSL environment variable.
Recent versions of Community MySQL does not support this global variable.
SSL/TLS support detection was extended to use status using:
@verbatim
mysql> SHOW STATUS LIKE 'ssl_cipher';
@endverbatim
The keatest_secure user requires X509 so a client certificate. Of course
in production a stricter requirement should be used, in particular when
a client certificate should be bound to a particular user.