0976ce107e
In the past, it was not possible download the CA certificates in any way, so we used channel_binding as a way to verify the server identity. However, now we give an option to download the CA certificates, so we can use sslmode=require by default, which also works with pgBouncer as opposed to channel_binding. Users that require higher security guarantees can download the CA certificates and use sslmode=verify-ca or sslmode=verify-full.