Postgres still connecting via SSL - despite invalid certificates

Question

I'm playing around with SSL connections to a test postgres server and I'm finding I can still initiate an SSL connection despite invalid certificates. (The valid date has expired)

I have enforced SSL connections in the pg_hba.conf

## pg_hba.conf - SSL TESTING
hostssl         mike            mike            192.168.56.106/32       md5

SSL Certificate is expired:

$ openssl x509 -in server.crt -noout -dates
notBefore=Feb 22 18:29:39 2019 GMT
notAfter=Feb 23 18:29:39 2019 GMT

Still able to connect via SSL:

postgres:/db/postgresql/10/data>psql "sslmode=require host=192.168.56.105 dbname=mike user=mike"
Password: 
psql (10.7)
SSL connection (protocol: TLSv1.2, cipher: ECDHE-RSA-AES256-GCM-SHA384, bits: 256, compression: off)
Type "help" for help.
mike=> 

Why can I still connect?

I'm hoping for a situation where the connection is rejected because the certificate is invalid - am I missing something? Any help appreciated :)

Answer 1

The documentation says:

By default, PostgreSQL will not perform any verification of the server certificate.

In other words, SSL is used for encryption.

[…]
To allow the client to verify the identity of the server, place a root certificate on the client and a leaf certificate signed by the root certificate on the server.
[…]
Once a chain of trust has been established, there are two ways for the client to validate the leaf certificate sent by the server. If the parameter sslmode is set to verify-ca, libpq will verify that the server is trustworthy by checking the certificate chain up to the root certificate stored on the client. If sslmode is set to verify-full, libpq will also verify that the server host name matches the name stored in the server certificate.