Hugh Cole-Baker 448f735d55 Fix Store PostgreSQL channel binding (#3212) ...

The former behaviour to always use a SHA-256 hash of the server
certificate for the tls-server-end-point channel binding was
incorrect with regard to RFC5929, which specifies if the signature
algorithm uses a single hash function, that hash function should be
used, unless the signature algorithm uses MD5 or SHA-1, in which
case the channel binding should use an SHA-256 hash.

This change attempts to align with the behaviour of OpenSSL, used
by PostgreSQL, in using the signature algorithm's hash function.

2026-07-08 23:00:16 +02:00

3.6 KiB

Raw Blame History

View Raw