@@ -385,63 +385,70 @@ PGconn *PQconnectdbParams(const char **keywords, const char **values, int expand
385385 This option determines whether or with what priority a secure
386386 <acronym>SSL</> TCP/IP connection will be negotiated with the
387387 server. There are six modes:
388- </para>
389388
390- <table id="libpq-connect-sslmode-options">
391- <title><literal>sslmode</literal> Options</title>
392- <tgroup cols="2">
393- <thead>
394- <row>
395- <entry>Option</entry>
396- <entry>Description</entry>
397- </row>
398- </thead>
399-
400- <tbody>
401-
402- <row>
403- <entry><literal>disable</></entry>
404- <entry>only try a non-<acronym>SSL</> connection</entry>
405- </row>
406-
407- <row>
408- <entry><literal>allow</></entry>
409- <entry>first try a non-<acronym>SSL</>
410- connection; if that fails, try an <acronym>SSL</>
411- connection</entry>
412- </row>
413-
414- <row>
415- <entry><literal>prefer</> (default)</entry>
416- <entry>first try an <acronym>SSL</> connection; if
417- that fails, try a non-<acronym>SSL</>
418- connection</entry>
419- </row>
420-
421- <row>
422- <entry><literal>require</></entry>
423- <entry>only try an <acronym>SSL</> connection</entry>
424- </row>
425-
426- <row>
427- <entry><literal>verify-ca</></entry>
428- <entry>only try an <acronym>SSL</> connection, and verify that
429- the server certificate is issued by a trusted certificate
430- authority (<acronym>CA</>)</entry>
431- </row>
432-
433- <row>
434- <entry><literal>verify-full</></entry>
435- <entry>only try an <acronym>SSL</> connection, verify that
436- the server certificate is issued by a trusted <acronym>CA</> and
437- that the server host name matches that in the certificate</entry>
438- </row>
439-
440- </tbody>
441- </tgroup>
442- </table>
389+ <variablelist>
390+ <varlistentry>
391+ <term><literal>disable</literal></term>
392+ <listitem>
393+ <para>
394+ only try a non-<acronym>SSL</> connection
395+ </para>
396+ </listitem>
397+ </varlistentry>
398+
399+ <varlistentry>
400+ <term><literal>allow</literal></term>
401+ <listitem>
402+ <para>
403+ first try a non-<acronym>SSL</> connection; if that
404+ fails, try an <acronym>SSL</> connection
405+ </para>
406+ </listitem>
407+ </varlistentry>
408+
409+ <varlistentry>
410+ <term><literal>prefer</literal> (default)</term>
411+ <listitem>
412+ <para>
413+ first try an <acronym>SSL</> connection; if that fails,
414+ try a non-<acronym>SSL</> connection
415+ </para>
416+ </listitem>
417+ </varlistentry>
418+
419+ <varlistentry>
420+ <term><literal>require</literal></term>
421+ <listitem>
422+ <para>
423+ only try an <acronym>SSL</> connection
424+ </para>
425+ </listitem>
426+ </varlistentry>
427+
428+ <varlistentry>
429+ <term><literal>verify-ca</literal></term>
430+ <listitem>
431+ <para>
432+ only try an <acronym>SSL</> connection, and verify that
433+ the server certificate is issued by a trusted
434+ certificate authority (<acronym>CA</>)
435+ </para>
436+ </listitem>
437+ </varlistentry>
438+
439+ <varlistentry>
440+ <term><literal>verify-full</literal></term>
441+ <listitem>
442+ <para>
443+ only try an <acronym>SSL</> connection, verify that the
444+ server certificate is issued by a
445+ trusted <acronym>CA</> and that the server host name
446+ matches that in the certificate
447+ </para>
448+ </listitem>
449+ </varlistentry>
450+ </variablelist>
443451
444- <para>
445452 See <xref linkend="libpq-ssl"> for a detailed description of how
446453 these options work.
447454 </para>
@@ -6773,30 +6780,23 @@ ldap://ldap.acme.com/cn=dbserver,cn=hosts?pgconnectinfo?base?(objectclass=*)
67736780 The different values for the <literal>sslmode</> parameter provide different
67746781 levels of protection. SSL can provide
67756782 protection against three types of attacks:
6776- </para>
6777- <table id="libpq-ssl-protect-attacks">
6778- <title>SSL Attacks</title>
6779- <tgroup cols="2">
6780- <thead>
6781- <row>
6782- <entry>Type</entry>
6783- <entry>Description</entry>
6784- </row>
6785- </thead>
67866783
6787- <tbody>
6788- <row>
6789- <entry>Eavesdropping</entry>
6790- <entry>If a third party can examine the network traffic between the
6784+ <variablelist>
6785+ <varlistentry>
6786+ <term>Eavesdropping</term>
6787+ <listitem>
6788+ <para>If a third party can examine the network traffic between the
67916789 client and the server, it can read both connection information (including
67926790 the user name and password) and the data that is passed. <acronym>SSL</>
67936791 uses encryption to prevent this.
6794- </entry>
6795- </row>
6792+ </para>
6793+ </listitem>
6794+ </varlistentry>
67966795
6797- <row>
6798- <entry>Man in the middle (<acronym>MITM</>)</entry>
6799- <entry>If a third party can modify the data while passing between the
6796+ <varlistentry>
6797+ <term>Man in the middle (<acronym>MITM</>)</term>
6798+ <listitem>
6799+ <para>If a third party can modify the data while passing between the
68006800 client and server, it can pretend to be the server and therefore see and
68016801 modify data <emphasis>even if it is encrypted</>. The third party can then
68026802 forward the connection information and data to the original server,
@@ -6805,21 +6805,23 @@ ldap://ldap.acme.com/cn=dbserver,cn=hosts?pgconnectinfo?base?(objectclass=*)
68056805 to a different server than intended. There are also several other
68066806 attack methods that can accomplish this. <acronym>SSL</> uses certificate
68076807 verification to prevent this, by authenticating the server to the client.
6808- </entry>
6809- </row>
6808+ </para>
6809+ </listitem>
6810+ </varlistentry>
68106811
6811- <row>
6812- <entry>Impersonation</entry>
6813- <entry>If a third party can pretend to be an authorized client, it can
6812+ <varlistentry>
6813+ <term>Impersonation</term>
6814+ <listitem>
6815+ <para>If a third party can pretend to be an authorized client, it can
68146816 simply access data it should not have access to. Typically this can
68156817 happen through insecure password management. <acronym>SSL</> uses
68166818 client certificates to prevent this, by making sure that only holders
68176819 of valid certificates can access the server.
6818- </entry >
6819- </row >
6820- </tbody >
6821- </tgroup >
6822- </table >
6820+ </para >
6821+ </listitem >
6822+ </varlistentry >
6823+ </variablelist >
6824+ </para >
68236825
68246826 <para>
68256827 For a connection to be known secure, SSL usage must be configured
@@ -6844,9 +6846,9 @@ ldap://ldap.acme.com/cn=dbserver,cn=hosts?pgconnectinfo?base?(objectclass=*)
68446846 <para>
68456847 All <acronym>SSL</> options carry overhead in the form of encryption and
68466848 key-exchange, so there is a tradeoff that has to be made between performance
6847- and security. The following table illustrates the risks the different
6848- <literal>sslmode</> values protect against, and what statement they make
6849- about security and overhead:
6849+ and security. <xref linkend="libpq-ssl-sslmode-statements">
6850+ illustrates the risks the different <literal>sslmode</> values
6851+ protect against, and what statement they make about security and overhead.
68506852 </para>
68516853
68526854 <table id="libpq-ssl-sslmode-statements">
@@ -6942,6 +6944,12 @@ ldap://ldap.acme.com/cn=dbserver,cn=hosts?pgconnectinfo?base?(objectclass=*)
69426944
69436945 <sect2 id="libpq-ssl-fileusage">
69446946 <title>SSL Client File Usage</title>
6947+
6948+ <para>
6949+ <xref linkend="libpq-ssl-file-usage"> summarizes the files that are
6950+ relevant to the SSL setup on the client.
6951+ </para>
6952+
69456953 <table id="libpq-ssl-file-usage">
69466954 <title>Libpq/Client SSL File Usage</title>
69476955 <tgroup cols="3">
0 commit comments