public inbox for [email protected]  

help / color / mirror / Atom feed

From: Valere Binet <[email protected]>
To: Tom Lane <[email protected]>
Cc: [email protected]
Subject: Re: FATAL: connection requires a valid client certificate
Date: Fri, 20 Jun 2025 13:24:44 -0400
Message-ID: <CAJn2Pj=E0kS5aQAd=mek=atZPA0iHz9dvk-VU0Xo2=+eiJZ7ow@mail.gmail.com> (raw)
In-Reply-To: <[email protected]>
References: <CAJn2Pj=dTF=LpYiO9SyyKQoyrDEMO=UeQxb+br4qmuAYpVUU5A@mail.gmail.com>
	<[email protected]>

Thank you Tom,

I already had the full path for the root certificate, sorry I got lazy
retyping the command on my personal computer.
After also entering the full path for sslcert and sslkey, I'm getting
"sslv3 alert certificate expired".
Now I just need to figure out which one but I already have a pretty good
idea.

Thank you again! Regards,

Valère

On Fri, Jun 20, 2025 at 12:02 PM Tom Lane <[email protected]> wrote:

> Valere Binet <[email protected]> writes:
> > I'm completely new to postgresql and I'm struggling with its SSL
> > configuration.
>
> It sounds like you have the right certs in the right files.
> I wonder though whether the client is actually picking up the
> client-side cert/key.
>
> In particular, a quick look at the libpq source code indicates
> that it doesn't have any mechanism for expanding "~" in the sslcert
> etc. parameters: you need to write out the full path verbatim.
> (But it also looks like you should have gotten an error about
> not finding the sslrootcert file, so I'm not quite sure if this
> theory is correct.)
>
> Another thing to look into is whether the order of the certs
> in the multi-cert files matters.
>
>                         regards, tom lane
>

reply

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: [email protected]
  Cc: [email protected], [email protected], [email protected]
  Subject: Re: FATAL: connection requires a valid client certificate
  In-Reply-To: <CAJn2Pj=E0kS5aQAd=mek=atZPA0iHz9dvk-VU0Xo2=+eiJZ7ow@mail.gmail.com>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox