From: Tom Lane <tgl@sss.pgh.pa.us>
To: "Zwettler Markus (OIZ)" <Markus.Zwettler@zuerich.ch>
cc: "pgsql-general@lists.postgresql.org" <pgsql-general@lists.postgresql.org>
Subject: Re: could not accept ssl connection tlsv1 alert unknown ca
In-reply-to: <GV0P278MB0099D57F417CC2985E16BDBB8BE92@GV0P278MB0099.CHEP278.PROD.OUTLOOK.COM>
References: <GV0P278MB0099D57F417CC2985E16BDBB8BE92@GV0P278MB0099.CHEP278.PROD.OUTLOOK.COM>
Comments: In-reply-to "Zwettler Markus (OIZ)" <Markus.Zwettler@zuerich.ch>
	message dated "Thu, 30 Jan 2025 17:21:02 +0000"
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <3294021.1738259448.1@sss.pgh.pa.us>
Content-Transfer-Encoding: quoted-printable
Date: Thu, 30 Jan 2025 12:50:48 -0500
Message-ID: <3294022.1738259448@sss.pgh.pa.us>
Archived-At: <https://www.postgresql.org/message-id/3294022.1738259448%40sss.pgh.pa.us>
Precedence: bulk

"Zwettler Markus (OIZ)" <Markus.Zwettler@zuerich.ch> writes:
> However, one client also configured some client certificates + "sslmode=3D=
prefer" which resulted in "could not accept ssl connection tlsv1 alert unk=
nown ca".

I'm no expert, but I think this typically means a missing or untrusted
intermediate certificate, that is no chain of trust to one of the
certs that your OpenSSL considers trusted.

> I always thought that Postgres does only validate certificates with "ssl=
mode=3Dverify-ca" and "sslmode=3Dverify-full" =3D> https://www.postgresql.=
org/docs/current/libpq-ssl.html

Those cause some additional checks to be made, but it's not like
you can expect a completely broken certificate to work without them.

			regards, tom lane