From: Tom Lane <tgl@sss.pgh.pa.us>
To: Andrus <kobruleht2@hot.ee>
cc: pgsql-bugs@lists.postgresql.org
Subject: Re: tlsv1 alert unknown ca error on cert authentication
In-reply-to: <2d836545-781e-4340-9216-687b51036a71@hot.ee>
References: <2d836545-781e-4340-9216-687b51036a71@hot.ee>
Comments: In-reply-to Andrus <kobruleht2@hot.ee>
	message dated "Sun, 08 Jun 2025 15:21:40 +0300"
MIME-Version: 1.0
Content-Type: text/plain; charset="UTF-8"
Content-ID: <197870.1749399247.1@sss.pgh.pa.us>
Content-Transfer-Encoding: 8bit
Date: Sun, 08 Jun 2025 12:14:07 -0400
Message-ID: <197871.1749399247@sss.pgh.pa.us>
Archived-At: 
 <https://www.postgresql.org/message-id/197871.1749399247%40sss.pgh.pa.us>
Precedence: bulk

Andrus <kobruleht2@hot.ee> writes:
> Observed:

>>> pg_dump: error: connection to server at "localhost" (::1), port 5432
>>> failed: SSL error: tlsv1 alert unknown ca

> Postgres log contains:

>>> [unknown] ::1 [unknown] LOG:  could not accept SSL connection:
>>> certificate verify failed [unknown] ::1 [unknown] DETAIL: Client
>>> certificate verification failed at depth 0: self-signed certificate.

Hm.  This example works fine for me on RHEL8.  Evidently your
openssl installation is set up to reject self-signed certificates
by default.  I note that in my installation, /etc/pki/tls/openssl.cnf
contains

[ req ]
...
x509_extensions	= v3_ca	# The extensions to add to the self signed cert
...
[ v3_ca ]
# Extensions for a typical CA
...
# Key usage: this is typical for a CA certificate. However since it will
# prevent it being used as an test self-signed certificate it is best
# left out by default.
# keyUsage = cRLSign, keyCertSign

Perhaps in your configuration file, that option is active?

			regards, tom lane