I want to configure SSL so that clients can only require certificate signed by root CA ca.crt, then every client must use their issued e.g. cert postgresql.crt, key postgresql.key and password to connect to database server. Hereby allowing the database server to verify each client certificate on authentication.

Postgres v14 server configs:


ssl = on
ssl_ca_file = ca.crt   # root CA or (root+intermediate CA bundle) that signed client cert.
#ssl_cert_file =
#ssl_key_file =


hostssl  all  all  all  md5  clientcert=verify-ca

Starting database server failed with this error.

FATAL: could not load server certificate file "server.crt": No such file or directory

Why does it fail, I've no need for server.crt and server.key because server should be doing the client verification using ca.crt not the client?

Reading postgres document doesn't help me. Thanks in advance.

  • Have you tried using the /full path/ to the crt file in postgresql.conf?
    – Phill W.
    Commented Oct 4, 2022 at 12:51
  • I've no need for server.crt and server.key -- may be you don't, but the server certainly does.
    – mustaccio
    Commented Oct 4, 2022 at 13:35
  • While it may be possible to construct a system which uses client certs and makes server certs optional, that is not what has been done. If you want to use SSL, you will need to have a server cert, even if you don't do anything interesting with it.
    – jjanes
    Commented Oct 4, 2022 at 20:12
  • @PhillW. I try /full path/cat.crt but is still requesting server.crt on the start.
    – themsay
    Commented Oct 12, 2022 at 2:53

1 Answer 1


You also have to provide the server certificate (by default server.crt) and the corresponding private key (default server.key with restrictive permissions) in the data directory, otherwise you cannot start with SSL support.

To verify the client certificate, you should use md5 clientcert=verify-full in pg_hba.conf. If you don't need that extra password, and the client certificate is enough for authentication, you could simply use certificate authentication:

hostssl  all  all  all  cert
  • While I provide server.crt and server.key on server side it start successful. psql failed to connect if I do not provide root.crt on the client side even after configuring clientcert=verify-full, on providing root.crt with both postgresql.crt and postgresql.key I notice client cert was ignored and that's not good. Could that be a bug or something.
    – themsay
    Commented Oct 12, 2022 at 3:29
  • Not a bug, but your mistake. Either the common name in the server certificate is not correct, or you didn't specify sslrootcert correctly on the client side. Commented Oct 12, 2022 at 5:56
  • I don't want the same CN on both server side cert and all clients side cert. I want each client cert should use client postgres user name as their CN, but I'm facing an error on the server side CN because it doesn't match with each individual client CN. Postgres docs is great but in this use case is not clear on Client Certificate Authentication setup. @LaurenzAlbe thanks for the support.
    – themsay
    Commented Oct 13, 2022 at 16:35
  • I cannot really follow that. But I gather that you understand the cause of the problem now? Commented Oct 14, 2022 at 10:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.