Postgres SSL client certificate - database server CA failed to start

Question

I want to configure SSL so that clients can only require certificate signed by root CA ca.crt, then every client must use their issued e.g. cert postgresql.crt, key postgresql.key and password to connect to database server. Hereby allowing the database server to verify each client certificate on authentication.

Postgres v14 server configs:

postgresql.conf

...
ssl = on
ssl_ca_file = ca.crt   # root CA or (root+intermediate CA bundle) that signed client cert.
#ssl_cert_file =
#ssl_key_file =
...

pg_hba.conf

...
hostssl  all  all  all  md5  clientcert=verify-ca
...

Starting database server failed with this error.

...
FATAL: could not load server certificate file "server.crt": No such file or directory
...

Why does it fail, I've no need for server.crt and server.key because server should be doing the client verification using ca.crt not the client?

Reading postgres document doesn't help me. Thanks in advance.

Answer 1

You also have to provide the server certificate (by default server.crt) and the corresponding private key (default server.key with restrictive permissions) in the data directory, otherwise you cannot start with SSL support.

To verify the client certificate, you should use md5 clientcert=verify-full in pg_hba.conf. If you don't need that extra password, and the client certificate is enough for authentication, you could simply use certificate authentication:

hostssl  all  all  all  cert