Fix Store PostgreSQL channel binding (#3212)

The former behaviour to always use a SHA-256 hash of the server
certificate for the tls-server-end-point channel binding was
incorrect with regard to RFC5929, which specifies if the signature
algorithm uses a single hash function, that hash function should be
used, unless the signature algorithm uses MD5 or SHA-1, in which
case the channel binding should use an SHA-256 hash.

This change attempts to align with the behaviour of OpenSSL, used
by PostgreSQL, in using the signature algorithm's hash function.

This commit is contained in:

Hugh Cole-Baker

2026-07-08 22:00:16 +01:00

committed by

GitHub

parent 1cadee382f

commit 448f735d55

3 changed files with 69 additions and 5 deletions

1

Cargo.lock generated

View File

@@ -8004,6 +8004,7 @@ dependencies = [
  "trc",
  "types",
  "utils",
  "x509-parser",
  "xxhash-rust",
 ]

Fix Store PostgreSQL channel binding (#3212)

1 Cargo.lock generated Unescape Escape View File

1

Cargo.lock generated

View File