Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1triws-0088me-C1 for pgsql-es-ayuda@arkaria.postgresql.org; Mon, 10 Mar 2025 19:38:02 +0000 Received: from localhost ([127.0.0.1] helo=malur.postgresql.org) by malur.postgresql.org with esmtp (Exim 4.94.2) (envelope-from ) id 1triwq-00H7Qy-Mh for pgsql-es-ayuda@arkaria.postgresql.org; Mon, 10 Mar 2025 19:38:00 +0000 Received: from magus.postgresql.org ([2a02:c0:301:0:ffff::29]) by malur.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1triwq-00H7Qo-EN for pgsql-es-ayuda@lists.postgresql.org; Mon, 10 Mar 2025 19:38:00 +0000 Received: from mail-pl1-x633.google.com ([2607:f8b0:4864:20::633]) by magus.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (Exim 4.96) (envelope-from ) id 1triwm-00261q-2C for pgsql-es-ayuda@postgresql.org; Mon, 10 Mar 2025 19:38:00 +0000 Received: by mail-pl1-x633.google.com with SMTP id d9443c01a7336-2240b4de12bso79445225ad.2 for ; Mon, 10 Mar 2025 12:37:57 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1741635476; x=1742240276; darn=postgresql.org; h=to:in-reply-to:cc:references:message-id:date:subject:mime-version :from:content-transfer-encoding:from:to:cc:subject:date:message-id :reply-to; bh=7J4Rm9ffSRuyyehwJ1P1bnNwV+bjwtfsGxXDZ+43xso=; b=DaQs30h+zc1o8KtQxfCoOKwD2y/vEi6wFHpY0HGNHeHkSt1+3xVAN6HBbxhwNqzz32 oc05ofsSyhDoSA7W+q6pMg7n8uN3VerKFOu/f/aS5pjGgh0uiEHC+2oy+ggVIsyPeJU3 B1w2P4w+M3yOBcBwUOX3G1DdPLBn24aTaqWd0ex9q1DL9JdxdjopFCjx6CzDGVCVoR2W fvTfwCmX+9tiumY5hu+fEmEhyYcAW0KdprEq51xZIEfJokfRrJQvZCwXhFgJhw4rT90O hmXrd3AHY8e63/S0tsVM/v75YQJoR23cEkMrmyngGD7XNCYzxk8ckuJMNGQTpDmodrIX XdYg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1741635476; x=1742240276; h=to:in-reply-to:cc:references:message-id:date:subject:mime-version :from:content-transfer-encoding:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=7J4Rm9ffSRuyyehwJ1P1bnNwV+bjwtfsGxXDZ+43xso=; b=QHD/9dtMO/eQXxWuVJM9IWlmgvWeMkgE4rFRpIvHki8SPbmnTH0JY6ELa4dg6BjZ3G jCAGVvKNey5osi8/FyFhgVvV3cHLldHGx5NHCcET+Fg+5BYWQxO+x1z4+r4OFKi3WSHx tT1dR4To0eMcRWscQ//5XfNgj72WGe4f6wDNgMAjaORpApWOgz46XeQvYBKd47QOl/i1 YpK5oL864C1pBDcLlOrrIuHPOBMe2OYOlIQqE1JZDbszfPmzdS/s62+z2YnQRLLJaAwj bWxCGvn349luTN64p/Mg/1WT0kNW5PPHvbTqWy8wV077tdBMomtiXIx3mESzgnHCECUJ FsOw== X-Gm-Message-State: AOJu0YwqfUCjzPpRwtpJtIvM5jVvPhUjc2lgVzcUn0iGMooKZ0ZpwC1a 5207CCSPFryFWFM2d2pYkfcgIq2g3M6nARPODw6Vg3ENjJ21lVyd X-Gm-Gg: ASbGncvOORXg+yh53R23zWQNTThg6MTGw8bDPx5xN5YGQHYVC1D/ZclWWn2GEsTVaVS YYMRvWTdeie9Mk/8Drun5qLeTVOIi8qNyYU0xpQUiuOv1wZp5tNpeeI/AvkSGEjxjmv0G22vlUL kDMt6Kh6yRznw+zEC9G3Jp+Wx25mBK2JnSnONN04Kpj2M5761kH6GtwiVxQDQPzvD0AYESbgHwQ SvpbjDdh0PK9OWwExXAGOh0QtQ40g2VM2J6Xmhxjvyh4xcMaMEjg0A9R4+CBXHrpZgpwn8XwCov ByGGPbRoImtUd32leuKnzpQrh1814Pe1milOKAywiMLcoPGIG6/fTQMLJIk= X-Google-Smtp-Source: AGHT+IEQ9+5TR/Ksw1oISj+jcr10pe13tc4Ltg7XSyjr/gMQsDSjAEbkJgqGoSCCQ5DBKNKqg9H+Eg== X-Received: by 2002:a17:903:40cb:b0:21f:85ee:f2df with SMTP id d9443c01a7336-2242888adfemr237225405ad.15.1741635475927; Mon, 10 Mar 2025 12:37:55 -0700 (PDT) Received: from smtpclient.apple ([60.234.167.88]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-22410a7f9f9sm82346265ad.125.2025.03.10.12.37.55 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Mon, 10 Mar 2025 12:37:55 -0700 (PDT) Content-Type: multipart/alternative; boundary=Apple-Mail-6DBA1C6D-E567-4820-BD01-C52BEE728517 Content-Transfer-Encoding: 7bit From: Horacio Miranda Mime-Version: 1.0 (1.0) Subject: =?utf-8?Q?Re:_Autenticaci=C3=B3n_TSL?= Date: Tue, 11 Mar 2025 08:37:23 +1300 Message-Id: References: Cc: pgsql-es-ayuda In-Reply-To: To: "Guillermo E. Villanueva" X-Mailer: iPhone Mail (22D8075) List-Id: List-Help: List-Subscribe: List-Post: List-Owner: List-Archive: Archived-At: Precedence: bulk --Apple-Mail-6DBA1C6D-E567-4820-BD01-C52BEE728517 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable Dice que no conoce el CA.
Agrega el CA d= e let=E2=80=99s encrypt a tu Linux o en un archivo donde conoce el CA de let= s encrypt.
Ahora est=C3=A1s usando TLS o quieres usar mTLS ? =

Regar= ds,
Horacio Miranda


<= blockquote type=3D"cite">On 11 Mar 2025, at 5:37=E2=80=AFAM, Guillermo E. Vi= llanueva <guillermovil@gmail.com> wrote:

=EF=BB=BF
Buenas tar= des! En los =C3=BAltimos d=C3=ADas estuve trabajando en el proyecto de hacer= funcionar postgres 13, con autenticaci=C3=B3n por certificados ssl, usando o= penssl y certificados firmados por una propia CA funcion=C3=B3 correctamente= , pero cuando intento hacerlo con certificados Let's Encrypt para el servido= r, no funciona. 

Desde el cliente con credencia= les de lets encrypt
psql "host=3Dhost.dominio.com dbname=3Dpostgres user=3Dpostgres s= slmode=3Dverify-ca sslcert=3D./fullchain.pem sslkey=3D./privkey.pem sslrootc= ert=3D./chain.pem"
Error:
psql: error:= connection to server at " ho= st.dominio.com" (ip), port 5432 failed: S= SL error: certificate verify failed

Y en el log de postgres:
2025-03-10 15:29= :18.080 CET [893999] [unknown]@[unknown] LOG:  connection received: hos= t=3Dip_del_cliente port=3D55848
2025-03-10 15:29:18.093 CET [893999] [unk= nown]@[unknown] LOG:  could not accept SSL connection: tlsv1 alert unkn= own ca

Tambien lo prob=C3=A9 con certificados autofirmados par= a el cliente adaptando postgresql.conf y pg_hba.conf, pero no hay caso, no l= ogro hacerlo funcionar. 

Alguno de por ac=C3=A1 pudo hace= r funcionar autenticaci=C3=B3n con Let's Encrypt?

=
Desde ya muchas gracias por leer y por los comentarios que tengan.

Saludos
= --Apple-Mail-6DBA1C6D-E567-4820-BD01-C52BEE728517--