From: Tom Lane <tgl@sss.pgh.pa.us>
To: Nikhil Shetty <nikhil.dba04@gmail.com>
cc: Pgsql-admin <pgsql-admin@lists.postgresql.org>
Subject: Re: Question on SSL certificate expiry
In-reply-to: 
 <CAFpL5Vwbf15c1isEreO1zSrEwkMXJ44kX4NywtpstzEav5p=Vg@mail.gmail.com>
References: 
 <CAFpL5Vwbf15c1isEreO1zSrEwkMXJ44kX4NywtpstzEav5p=Vg@mail.gmail.com>
Comments: In-reply-to Nikhil Shetty <nikhil.dba04@gmail.com>
	message dated "Thu, 01 Jun 2023 17:10:22 +0530"
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <3779.1685624838.1@sss.pgh.pa.us>
Date: Thu, 01 Jun 2023 09:07:18 -0400
Message-ID: <3780.1685624838@sss.pgh.pa.us>
Archived-At: 
 <https://www.postgresql.org/message-id/3780.1685624838%40sss.pgh.pa.us>
Precedence: bulk

Nikhil Shetty <nikhil.dba04@gmail.com> writes:
> We were using MTLS to connect to the database. We noticed that even after
> server certificates expired the client was able to connect to the database.

> 1. Doesn't postgres check the expiry date of the certificate?

Postgres does not.  The openssl library can.  The most likely
guess, on the basis of the next-to-zero details you provided,
is that the connection is succeeding via some method that doesn't
require the client to check the server's certificate --- for
instance, a completely unencrypted connection.

			regards, tom lane