How ssl works in psql?

1
votes

In AWS RDS postgresql server side ssl has been forced using below config values.

rds.force_ssl   1
ssl 1

When I am trying to connect to postgres RDS host without specifying the sslmode and sslrootcert, it is allowing the ssl connection.

psql -h hostname.us-east-1.rds.amazonaws.com -p 5432 --user=username
psql (10.10 (Ubuntu 10.10-0ubuntu0.18.04.1), server 10.6)
SSL connection (protocol: TLSv1.2, cipher: ECDHE-RSA-AES256-GCM-SHA384, bits: 256, compression: off)
Type "help" for help.

username=>

Since I did not specify the sslmode, it has taken default sslmode which is prefer. I would like to know:

  1. How is it encrypting the data in transit to the server?
  2. How is it selecting ssl protocol, ssl cipher and compression before sending the data packets to server?
  3. Since I am not specifying any sslrootcert, is it taking any default cert for ssl handshake with server?

Please explain.

1
postgresqlamazon-web-servicessslamazon-rdspsql

1 Answers

1
votes
  1. Isn't "ECDHE-RSA-AES256-GCM-SHA384" the answer to this? If not, can you expand your question?
  2. As far as I know, this is just outsourced to the ssl library. PostgreSQL doesn't do anything special, other than pass along the configuration options.
  3. It will take the sslrootcert from the default location if it finds one there (in which case, the validation would probably fail, if you didn't go out of way to put something appropriate there). But if it does not find one, then you basically only get Diffie-Hellman protection. It doesn't verify that the server's cert was actually signed by the claimed CA, nor that the cert "belongs" to the server's hostname. You only get protection from eavesdroppers, not from MITM. If the client wants MITM protection, it must set sslmode to a level higher than 'require'.

There is no mechanism implemented by which the server can force the client to validate the server's cert.