MIME-Version: 1.0
References: 
 <CAJn2Pj=dTF=LpYiO9SyyKQoyrDEMO=UeQxb+br4qmuAYpVUU5A@mail.gmail.com>
 <1944831.1750435366@sss.pgh.pa.us>
In-Reply-To: <1944831.1750435366@sss.pgh.pa.us>
From: Valere Binet <valere.binet@gmail.com>
Date: Fri, 20 Jun 2025 13:24:44 -0400
Message-ID: 
 <CAJn2Pj=E0kS5aQAd=mek=atZPA0iHz9dvk-VU0Xo2=+eiJZ7ow@mail.gmail.com>
Subject: Re: FATAL: connection requires a valid client certificate
To: Tom Lane <tgl@sss.pgh.pa.us>
Cc: pgsql-admin@lists.postgresql.org
Content-Type: multipart/alternative; boundary="000000000000079f4f0638042459"
Archived-At: 
 <https://www.postgresql.org/message-id/CAJn2Pj%3DE0kS5aQAd%3Dmek%3DatZPA0iHz9dvk-VU0Xo2%3D%2BeiJZ7ow%40mail.gmail.com>
Precedence: bulk

--000000000000079f4f0638042459
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Thank you Tom,

I already had the full path for the root certificate, sorry I got lazy
retyping the command on my personal computer.
After also entering the full path for sslcert and sslkey, I'm getting
"sslv3 alert certificate expired".
Now I just need to figure out which one but I already have a pretty good
idea.

Thank you again! Regards,

Val=C3=A8re

On Fri, Jun 20, 2025 at 12:02=E2=80=AFPM Tom Lane <tgl@sss.pgh.pa.us> wrote=
:

> Valere Binet <valere.binet@gmail.com> writes:
> > I'm completely new to postgresql and I'm struggling with its SSL
> > configuration.
>
> It sounds like you have the right certs in the right files.
> I wonder though whether the client is actually picking up the
> client-side cert/key.
>
> In particular, a quick look at the libpq source code indicates
> that it doesn't have any mechanism for expanding "~" in the sslcert
> etc. parameters: you need to write out the full path verbatim.
> (But it also looks like you should have gotten an error about
> not finding the sslrootcert file, so I'm not quite sure if this
> theory is correct.)
>
> Another thing to look into is whether the order of the certs
> in the multi-cert files matters.
>
>                         regards, tom lane
>

--000000000000079f4f0638042459
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div>Thank you Tom,</div><div><br></div><div>I already had=
 the full path for the root certificate, sorry I got lazy retyping the comm=
and on my personal computer.</div><div>After also entering the full path fo=
r sslcert and sslkey, I&#39;m getting &quot;sslv3 alert certificate expired=
&quot;.</div><div>Now I just need to figure out which one but I already hav=
e a pretty good idea.</div><div><br></div><div>Thank you again! Regards,</d=
iv><div><br></div><div>Val=C3=A8re</div></div><br><div class=3D"gmail_quote=
 gmail_quote_container"><div dir=3D"ltr" class=3D"gmail_attr">On Fri, Jun 2=
0, 2025 at 12:02=E2=80=AFPM Tom Lane &lt;<a href=3D"mailto:tgl@sss.pgh.pa.u=
s">tgl@sss.pgh.pa.us</a>&gt; wrote:<br></div><blockquote class=3D"gmail_quo=
te" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204=
);padding-left:1ex">Valere Binet &lt;<a href=3D"mailto:valere.binet@gmail.c=
om" target=3D"_blank">valere.binet@gmail.com</a>&gt; writes:<br>
&gt; I&#39;m completely new to postgresql and I&#39;m struggling with its S=
SL<br>
&gt; configuration.<br>
<br>
It sounds like you have the right certs in the right files.<br>
I wonder though whether the client is actually picking up the<br>
client-side cert/key.<br>
<br>
In particular, a quick look at the libpq source code indicates<br>
that it doesn&#39;t have any mechanism for expanding &quot;~&quot; in the s=
slcert<br>
etc. parameters: you need to write out the full path verbatim.<br>
(But it also looks like you should have gotten an error about<br>
not finding the sslrootcert file, so I&#39;m not quite sure if this<br>
theory is correct.)<br>
<br>
Another thing to look into is whether the order of the certs<br>
in the multi-cert files matters.<br>
<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=
=A0 =C2=A0 regards, tom lane<br>
</blockquote></div>

--000000000000079f4f0638042459--