MIME-Version: 1.0
From: Duygu Hasan <duyguhsnhsn@gmail.com>
Date: Tue, 29 Apr 2025 13:43:49 +0300
Message-ID: <CAD=oMR34FvA1rKon+rYvBiYhzqvbQb+Jj1ZkmSeugrTTqOLJcg@mail.gmail.com>
Subject: Pg client certificate auth
To: pgsql-general@postgresql.org
Content-Type: multipart/alternative; boundary="00000000000086e9140633e87a29"
Archived-At: <https://www.postgresql.org/message-id/CAD%3DoMR34FvA1rKon%2BrYvBiYhzqvbQb%2BJj1ZkmSeugrTTqOLJcg%40mail.gmail.com>
Precedence: bulk

--00000000000086e9140633e87a29
Content-Type: text/plain; charset="UTF-8"

Hello,
I am trying to deploy a PG db with client certificate auth. I have read the
documentation, but I have a few questions. One of my goals is to be able to
use two different CAs and as far as I see there is only one ssl_ca_file, I
have tried to concatenate my certs as cert chain and use them, it seems to
be working.
Since it's not fully documented, do you think this approach won't cause any
problems in the future? Generally, I need this because when I have
multiple  pg servers (primary and standby) I need to use SSL. So PG
requires the standby represents a valid client cert, but the client cert ca
I need to use for the standby can be different from the client cert ca that
will be issuing the other certs that I will be giving to the standard
users.

Thanks,
Duygu

--00000000000086e9140633e87a29
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">Hello,=C2=A0<br>I am trying to deploy a PG db with client =
certificate auth. I have read the documentation, but I have a few questions=
. One of my goals is to be able to use two different CAs and as far as I se=
e there is only one ssl_ca_file, I have tried to concatenate my certs as ce=
rt chain and use them, it seems to be working.=C2=A0<br>Since it&#39;s not=
=C2=A0fully documented, do you think this approach won&#39;t cause any prob=
lems in the future? Generally, I need this because when I have multiple=C2=
=A0 pg servers (primary and standby) I need to use SSL. So PG requires the =
standby represents a valid client cert, but the client cert ca I need to us=
e for the standby can be different from the client cert ca that will be iss=
uing the other certs that I will be giving=C2=A0to the standard users.=C2=
=A0<div><br></div><div>Thanks,=C2=A0<br>Duygu=C2=A0</div></div>

--00000000000086e9140633e87a29--