2

I'm trying to use letsencrypt to generate certs in order to encrypt communication between a remote client and my postgresql database server. I'm not sure how to get started on setting this up. What kind of certs do I need for the client? What cert files should I store on the server? I've gone through this documentation as reference but it's still unclear as to which certificates go where? Thanks in advance!

Edit: Some clarification since this question was put on hold: I was unsure of what to expect when trying to use letsencrypt. I understand the basics of ssl/tls. But I needed some clarification about whether the certs generated on the server need corresponding certs on the client. The accepted answer has since pointed me in the right direction and the linked postgresql documentation has helped as well.

Improve this question

1 Answer 1

Reset to default
3

I've found this article to be quite useful. Assuming you know how PostgreSQL HBA generally works (i.e., how pg_hba.conf and postgresql.conf work), you do the following:

  1. start up certbot and have letsencrypt generate the cert where it typically does
  2. create a script to let letsencrypt copy renewed certs and keys to $PGDATA
  3. make sure postgresql.conf and pg_hba.conf are configured properly
  4. restart Postgres. done
Improve this answer
2
  • That looks useful. What would my domain be in this case? I should've mentioned that the remote client communicates with postgresql through a script.
    – horsinaround
    Commented Nov 12, 2019 at 19:52
  • Your domain is supposed to simply be your server's hostname, as would be seen by a client. If an external client (outside your LAN), then your external domain name. If an internal client (inside your LAN), depending on how your network is set up, your server's hostname should be sufficient.
    – richyen
    Commented Nov 12, 2019 at 19:55

Not the answer you're looking for? Browse other questions tagged or ask your own question.