@@ -133,7 +133,7 @@ connect :: ConnectInfo -> IO Connection
133133connect = connectPostgreSQL . postgreSQLConnectionString
134134
135135-- | Attempt to make a connection based on a libpq connection string.
136−-- See <http://www.postgresql.org/docs/9.3/static/libpq-connect.html>
136+-- See <http://www.postgresql.org/docs/9.3/static/libpq-connect.html#LIBPQ-CONNSTRING>
137137-- for more information. Here is an example with some
138138-- of the most commonly used parameters:
139139--
@@ -184,6 +184,16 @@ connect = connectPostgreSQL . postgreSQLConnectionString
184184--
185185-- See <http://www.postgresql.org/docs/9.3/static/client-authentication.html>
186186-- for more information regarding the authentication process.
187+--
188+-- SSL/TLS will typically "just work" if your postgresql server supports or
189+-- requires it. However, note that libpq is trivially vulnerable to a MITM
190+-- attack without setting additional SSL parameters in the connection string.
191+-- In particular, @sslmode@ needs to set be @require@, @verify-ca@, or
192+-- @verify-full@ to perform certificate validation. When @sslmode@ is
193+-- @require@, then you will also need to have a @sslrootcert@ file,
194+-- otherwise no validation of the server's identity will be performed.
195+-- Client authentication via certificates is also possible via the
196+-- @sslcert@ and @sslkey@ parameters.
187197
188198connectPostgreSQL :: ByteString -> IO Connection
189199connectPostgreSQL connstr = do