Hopefully someone might be able to shed a light on this problem.
I've configured two servers, both of them have the same problem.
I've implemented SSL configuration, on PostgreSQL 11.18, I have created self-signed certificates, configured the postgresql.conf file with
ssl = on
ssl_ca_file = 'root.crt'
ssl_cert_file = 'server.crt'
ssl_key_file = 'server.key'
On the pg_hba.conf file I've added
# TYPE DATABASE USER ADDRESS METHOD
hostssl demo user_test 10.155.5.100/32 md5 clientcert=verify-full
For the client, I've created certificates with the CN=user_test defined, and I can connect with
psql "sslmode=verify-full sslcert=/location/user.crt sslkey=/location/user.key
sslrootcert=/location/root.crt host=10.5.1.57 dbname=demo user=user_test"
After I run the command on the client server, it asks for the password and it connects properly. I see the legend
SSL connection (protocol: TLSv1.2, cipher: ECDHE-RSA-AES256-GCM-SHA384, bits: 256, compression: off)
and I can confirm I am connected on the desired server, as I can see the expected databases.
The problem is that I can also run on the client server
psql -d demo -U user_test -h 10.5.1.57
it will ask for the password, and it connects.
The desired behaviour is to only allow connection if the certificates are provided.
- I'm making the connection between two Linux servers.
- All of the entries with the same user or ip in the pg_hba.conf are registered with hostssl and md5 clientcert=verify-full
- My server.crt and therefore my root.crt is defined with CN=10.5.1.57
- The server should still be able to accept other user connections without providing certificates.
Thanks a lot, I appreciate any help or hints on what might be wrong.