Hopefully someone might be able to shed a light on this problem.
I've configured two servers, both of them have the same problem.
I've implemented SSL configuration, on PostgreSQL 11.18, I have created self-signed certificates, configured the postgresql.conf file with
ssl = on ssl_ca_file = 'root.crt' ssl_cert_file = 'server.crt' ssl_key_file = 'server.key'
On the pg_hba.conf file I've added
# TYPE DATABASE USER ADDRESS METHOD hostssl demo user_test 10.155.5.100/32 md5 clientcert=verify-full
For the client, I've created certificates with the CN=user_test defined, and I can connect with
psql "sslmode=verify-full sslcert=/location/user.crt sslkey=/location/user.key sslrootcert=/location/root.crt host=10.5.1.57 dbname=demo user=user_test"
After I run the command on the client server, it asks for the password and it connects properly. I see the legend
SSL connection (protocol: TLSv1.2, cipher: ECDHE-RSA-AES256-GCM-SHA384, bits: 256, compression: off)
and I can confirm I am connected on the desired server, as I can see the expected databases.
The problem is that I can also run on the client server
psql -d demo -U user_test -h 10.5.1.57
it will ask for the password, and it connects.
The desired behaviour is to only allow connection if the certificates are provided.
- I'm making the connection between two Linux servers.
- All of the entries with the same user or ip in the pg_hba.conf are registered with hostssl and md5 clientcert=verify-full
- My server.crt and therefore my root.crt is defined with CN=10.5.1.57
- The server should still be able to accept other user connections without providing certificates.
Thanks a lot, I appreciate any help or hints on what might be wrong.
onand consult the server log file to troubleshoot.
clientcert=verify-fullafter those other lines. Also, what's the purpose of asking for the password when using the certificate-based authentication?
# local for Unix domain socket connections only local all all trust local all postgres trust # IPv4 local connections: host all all 127.0.0.1/32 md5 host all postgres 127.0.0.1/32 passwordAnd several others for connections for other users and ips, not related to this client server and all of them without ssl connection.