0

I'm playing around with SSL connections to a test postgres server and I'm finding I can still initiate an SSL connection despite invalid certificates. (The valid date has expired)

I have enforced SSL connections in the pg_hba.conf

## pg_hba.conf - SSL TESTING
hostssl         mike            mike            192.168.56.106/32       md5

SSL Certificate is expired:

$ openssl x509 -in server.crt -noout -dates
notBefore=Feb 22 18:29:39 2019 GMT
notAfter=Feb 23 18:29:39 2019 GMT

Still able to connect via SSL:

postgres:/db/postgresql/10/data>psql "sslmode=require host=192.168.56.105 dbname=mike user=mike"
Password: 
psql (10.7)
SSL connection (protocol: TLSv1.2, cipher: ECDHE-RSA-AES256-GCM-SHA384, bits: 256, compression: off)
Type "help" for help.
mike=> 

Why can I still connect?

I'm hoping for a situation where the connection is rejected because the certificate is invalid - am I missing something? Any help appreciated :)

1 Answer 1

1

The documentation says:

By default, PostgreSQL will not perform any verification of the server certificate.

In other words, SSL is used for encryption.

[…]
To allow the client to verify the identity of the server, place a root certificate on the client and a leaf certificate signed by the root certificate on the server.
[…]
Once a chain of trust has been established, there are two ways for the client to validate the leaf certificate sent by the server. If the parameter sslmode is set to verify-ca, libpq will verify that the server is trustworthy by checking the certificate chain up to the root certificate stored on the client. If sslmode is set to verify-full, libpq will also verify that the server host name matches the name stored in the server certificate.

1
  • It seems odd to me that you can initiate an SSL connection despite invalid certs (postgres performs no verification). It means we have no reason to maintain the certs if all we are after is encrypted connections and we are not bothered about server verification
    – Mike Gale
    Feb 26, 2019 at 16:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.