Fix connecting with VerifyCA and VerifyFull #5944
Conversation
This reverts commit 4f03989.
|
Backported to 9.0.2 via 47ee78b |
| @@ -932,7 +932,7 @@ internal async Task NegotiateEncryption(SslMode sslMode, NpgsqlTimeout timeout, | |||
| TargetHost = host, | |||
| ClientCertificates = clientCertificates, | |||
| EnabledSslProtocols = SslProtocols.None, | |||
| CertificateRevocationCheckMode = checkCertificateRevocation ? X509RevocationMode.Online : X509RevocationMode.Offline, | |||
| CertificateRevocationCheckMode = checkCertificateRevocation ? X509RevocationMode.Online : X509RevocationMode.NoCheck, | |||
There was a problem hiding this comment.
Just in case this was a "we changed this line of code, but don't know why it solved the problem":
RevocationMode.Online is basically bool? revoked = CheckCachedRevocation() ?? DownloadAndCacheRevocation(); where the null state is "OfflineRevocation | RevocationUnknown")
RevocationMode.Offline is just CheckCachedRevocation().
So Offline only works if anyone ever did Online (or somehow seeded the cache via different means). It's... basically... never the right answer.
Since Online checks the cache first, it's more "Online possible", vs "live". If you're talking to the same host repeatedly, it's functionally the same as Offline, but without the errors.
There was a problem hiding this comment.
I'm mostly confused as to why I used X509RevocationMode.Offline in the first place. Just looking at the previous implementation, we passed false to check for certificate revocation to SslStream, and in turn that passes X509RevocationMode.NoCheck, so I should have done the exact same thing...
Fixes #5942