pgjdbc/pgjdbc — pull request #88 by sehrope (2013-09-28 17:04:16+00:00)
Title: Add SSL factory SingleCertValidatingFactory

Add a new SSL socket factory that allows users to specify and verify
the SSL certificate of the remote server to prevent MITM attacks. The
socket factory allows for easily specifying and pinning of remote
server SSL certificates when creating a new connection to a database.
The SSL certificate can be specified as the String value of the
certificate itself, a file path, a classpath relative path, a system
property, or an environment variable.

Also included is a new test class that uses the new socket factory.
The test class is disabled by default but can be enabled by setting
`testsinglecertfactory=true` in the ssltests.properties config file.
By default the tests are configured to run against a SSL test database
VM running on localhost on the ports 10084, 10090, 10091, 10092, and
10093. To test against a different set of databases edit the test
parameters (JDBC URLs) at the top of the class.

The last test case pulls the SSL certificate from an enviroment var.
For it to run the env var must be set prior to running the test.
Otherwise the test is skipped. You can set it and run the test via:

$ DATASOURCE_SSL_CERT=$(cat certdir/goodroot.crt) ant clean test

The easiest way to test it and the JDBC SSL tests in general is to use the
test VM I put together. It's available at: https://github.com/jackdb/pgjdbc-test-vm

To use it:

1. Clone that repo
1. Install [Vagrant](http://vagrantup.com) and [Virtual Box](https://www.virtualbox.org/)
1. Start up the VM (from the repo's directory):

$ vagrant up
1. Create a file `build.local.properties` in your JDBC driver root directory with
the line `port=10093` (or replace that with a different port for a different server
version).

The VM that gets created is configured to run all the SSL tests (old and my new one)
and can also be used to run the non-SSL tests.