From: Tom Lane <tgl@sss.pgh.pa.us>
To: Valere Binet <valere.binet@gmail.com>
cc: pgsql-admin@lists.postgresql.org
Subject: Re: FATAL: connection requires a valid client certificate
In-reply-to: 
 <CAJn2Pj=dTF=LpYiO9SyyKQoyrDEMO=UeQxb+br4qmuAYpVUU5A@mail.gmail.com>
References: 
 <CAJn2Pj=dTF=LpYiO9SyyKQoyrDEMO=UeQxb+br4qmuAYpVUU5A@mail.gmail.com>
Comments: In-reply-to Valere Binet <valere.binet@gmail.com>
	message dated "Fri, 20 Jun 2025 11:35:25 -0400"
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <1944830.1750435366.1@sss.pgh.pa.us>
Date: Fri, 20 Jun 2025 12:02:46 -0400
Message-ID: <1944831.1750435366@sss.pgh.pa.us>
Archived-At: 
 <https://www.postgresql.org/message-id/1944831.1750435366%40sss.pgh.pa.us>
Precedence: bulk

Valere Binet <valere.binet@gmail.com> writes:
> I'm completely new to postgresql and I'm struggling with its SSL
> configuration.

It sounds like you have the right certs in the right files.
I wonder though whether the client is actually picking up the
client-side cert/key.

In particular, a quick look at the libpq source code indicates
that it doesn't have any mechanism for expanding "~" in the sslcert
etc. parameters: you need to write out the full path verbatim.
(But it also looks like you should have gotten an error about
not finding the sslrootcert file, so I'm not quite sure if this
theory is correct.)

Another thing to look into is whether the order of the certs
in the multi-cert files matters.

			regards, tom lane