pg.ddx.io pgsql-bugs@postgresql.org mailing list archive
help / color / mirror / Atom feedtlsv1 alert unknown ca error on cert authentication
5+ messages / 3 participants
[nested] [flat]
* tlsv1 alert unknown ca error on cert authentication
@ 2025-06-08 12:21 Andrus <kobruleht2@hot.ee>
0 siblings, 1 reply; 5+ messages in thread
From: Andrus @ 2025-06-08 12:21 UTC (permalink / raw)
To: pgsql-bugs@lists.postgresql.org
Steps to reproduce:
1. Install Postgres 17.5 and OpenSsl on Windows 11
2. Run the following commands. Enter `postgres` as common name on client
cert creation:
```sh
openssl req -new -x509 -days 365 -nodes -out server.crt -keyout
server.key
openssl req -new -nodes -out client.csr -keyout client.key
openssl x509 -req -in client.csr -CA server.crt -CAkey server.key
-CAcreateserial -out client.crt -days 365
```
3. Copy files to server data directory:
```sh
copy server.key "C:\Program Files\PostgreSQL\17\data"
copy server.crt "C:\Program Files\PostgreSQL\17\data\root.crt"
copy server.crt "C:\Program Files\PostgreSQL\17\data"
4. Add the following lines to top of `pg_hba.conf`:
hostssl all postgres ::1/0 cert
hostssl all postgres 0.0.0.0/0 cert
5. Add the following lines to end of `postgresql.conf`:
ssl = on
ssl_ca_file = 'root.crt'
ssl_cert_file = 'server.crt'
ssl_key_file = 'server.key'
6. Re-start postgres service
7. Run commands
```sh
set PGSSLCERT=client.crt
set PGSSLKEY=client.key
"C:\Program Files\PostgreSQL\17\bin\pg_dump" -f "test.backup" -F c
-h localhost -U postgres postgres
Observed:
> pg_dump: error: connection to server at "localhost" (::1), port 5432
> failed: SSL error: tlsv1 alert unknown ca
Postgres log contains:
> [unknown] ::1 [unknown] LOG: could not accept SSL connection:
> certificate verify failed [unknown] ::1 [unknown] DETAIL: Client
> certificate verification failed at depth 0: self-signed certificate.
> Failed certificate data (unverified): subject
> "...rju/L=test/O=test/CN=postgres/emailAddress=test@example.com",
> serial number 14465968192346824308, issuer
> "...rju/L=test/O=test/CN=postgres/emailAddress=test@example.com"
Reported also in
https://stackoverflow.com/questions/79657806/why-postgres-17-cert-authentication-fails-in-windows
Andrus.
^ permalink raw reply [nested|flat] 5+ messages in thread
* Re: tlsv1 alert unknown ca error on cert authentication
@ 2025-06-08 16:14 Tom Lane <tgl@sss.pgh.pa.us>
parent: Andrus <kobruleht2@hot.ee>
0 siblings, 2 replies; 5+ messages in thread
From: Tom Lane @ 2025-06-08 16:14 UTC (permalink / raw)
To: Andrus <kobruleht2@hot.ee>; +Cc: pgsql-bugs@lists.postgresql.org
Andrus <kobruleht2@hot.ee> writes:
> Observed:
>>> pg_dump: error: connection to server at "localhost" (::1), port 5432
>>> failed: SSL error: tlsv1 alert unknown ca
> Postgres log contains:
>>> [unknown] ::1 [unknown] LOG: could not accept SSL connection:
>>> certificate verify failed [unknown] ::1 [unknown] DETAIL: Client
>>> certificate verification failed at depth 0: self-signed certificate.
Hm. This example works fine for me on RHEL8. Evidently your
openssl installation is set up to reject self-signed certificates
by default. I note that in my installation, /etc/pki/tls/openssl.cnf
contains
[ req ]
...
x509_extensions = v3_ca # The extensions to add to the self signed cert
...
[ v3_ca ]
# Extensions for a typical CA
...
# Key usage: this is typical for a CA certificate. However since it will
# prevent it being used as an test self-signed certificate it is best
# left out by default.
# keyUsage = cRLSign, keyCertSign
Perhaps in your configuration file, that option is active?
regards, tom lane
^ permalink raw reply [nested|flat] 5+ messages in thread
* Re: tlsv1 alert unknown ca error on cert authentication
@ 2025-06-09 07:34 Andrus <kobruleht2@hot.ee>
parent: Tom Lane <tgl@sss.pgh.pa.us>
1 sibling, 0 replies; 5+ messages in thread
From: Andrus @ 2025-06-09 07:34 UTC (permalink / raw)
To: pgsql-bugs@lists.postgresql.org
Hi!
>Hm. This example works fine for me on RHEL8. Evidently your openssl installation is set up to reject self-signed certificates by
default.
Tried with RapidSSL cert for user varukoopia. Error message is the same.
> I note that in my installation, /etc/pki/tls/openssl.cnf
> contains
>
> [ req ]
> ...
> x509_extensions = v3_ca # The extensions to add to the self signed cert
> ...
> [ v3_ca ]
> # Extensions for a typical CA
> ...
> # Key usage: this is typical for a CA certificate. However since it will
> # prevent it being used as an test self-signed certificate it is best
> # left out by default.
> # keyUsage = cRLSign, keyCertSign
>
> Perhaps in your configuration file, that option is active?
It is not active.
Tried self signed cert for user varukoopia, but error message is the same.
Tried with
log_min_messages = debug5
but log does not contain more information about error
Certs used and openssl conf were sent to Tom as message attachments.
Andrus
^ permalink raw reply [nested|flat] 5+ messages in thread
* Re: tlsv1 alert unknown ca error on cert authentication
@ 2025-06-09 15:39 Jacob Champion <jacob.champion@enterprisedb.com>
parent: Tom Lane <tgl@sss.pgh.pa.us>
1 sibling, 1 reply; 5+ messages in thread
From: Jacob Champion @ 2025-06-09 15:39 UTC (permalink / raw)
To: Tom Lane <tgl@sss.pgh.pa.us>; +Cc: Andrus <kobruleht2@hot.ee>; pgsql-bugs@lists.postgresql.org
On Sun, Jun 8, 2025 at 9:14 AM Tom Lane <tgl@sss.pgh.pa.us> wrote:
> Hm. This example works fine for me on RHEL8. Evidently your
> openssl installation is set up to reject self-signed certificates
> by default.
I wonder if this setup is somewhat undefined/underdefined behavior.
Andrus, if I understand correctly, you have
- two certificates (one client, one server _and_ CA)
- with the same(!) Subject, according to the logs
- one signed the other (so it's "self-signed")
- one is marked CA, one is not
I have no idea how OpenSSL or the RFCs resolve this situation. Do you
really intend to have the CA share the same Subject as the client?
--Jacob
^ permalink raw reply [nested|flat] 5+ messages in thread
* Re: tlsv1 alert unknown ca error on cert authentication
@ 2025-06-09 20:40 Andrus <kobruleht2@hot.ee>
parent: Jacob Champion <jacob.champion@enterprisedb.com>
0 siblings, 0 replies; 5+ messages in thread
From: Andrus @ 2025-06-09 20:40 UTC (permalink / raw)
To: Jacob Champion <jacob.champion@enterprisedb.com>; Tom Lane <tgl@sss.pgh.pa.us>; +Cc: pgsql-bugs@lists.postgresql.org
Hi!
> I wonder if this setup is somewhat undefined/underdefined behavior.
>
> Andrus, if I understand correctly, you have
> - two certificates (one client, one server _and_ CA)
> - with the same(!) Subject, according to the logs
> - one signed the other (so it's "self-signed")
> - one is marked CA, one is not
>
> I have no idea how OpenSSL or the RFCs resolve this situation. Do you
> really intend to have the CA share the same Subject as the client?
No. It was mistake. You can close this bug report as invalid.
Andrus.
^ permalink raw reply [nested|flat] 5+ messages in thread
end of thread, other threads:[~2025-06-09 20:40 UTC | newest]
Thread overview: 5+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2025-06-08 12:21 tlsv1 alert unknown ca error on cert authentication Andrus <kobruleht2@hot.ee>
2025-06-08 16:14 ` Tom Lane <tgl@sss.pgh.pa.us>
2025-06-09 07:34 ` Andrus <kobruleht2@hot.ee>
2025-06-09 15:39 ` Jacob Champion <jacob.champion@enterprisedb.com>
2025-06-09 20:40 ` Andrus <kobruleht2@hot.ee>
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox