Skip to content

Configure PostgreSQL for OpenBAO client certificates

Make the server accept certificates that sluisctl psql fetches. For the client side, see Connect PostgreSQL.

Before you start

  • A certificate works until it expires. PostgreSQL ignores revocation unless ssl_crl_file or ssl_crl_dir is set.

Steps

# pg_hba.conf: type database user address method
hostssl orders all 10.0.0.0/8 cert

Point ssl_ca_file at the issuing_ca or ca_chain the role returns, which sluisctl writes as client-ca.crt. Use hostssl ... cert in pg_hba.conf. The cert method works only over hostssl and verifies the client certificate.

The database role must equal the certificate's CN. sluisctl psql sets PGUSER to that CN, so no map is needed. To map an email or github-<owner>-<repo> to a shorter role, add map=<name> to the line and a matching pg_ident.conf section, and connect with -U <role>. See PostgreSQL's client certificates and username maps.

For CloudNativePG, a custom client CA replaces the cluster's trust store. Set both fields under spec.certificates on the Cluster:

  • clientCASecret: the secret holding the CA's ca.crt.
  • replicationTLSSecret: a kubernetes.io/tls secret with a certificate for streaming_replica.

These follow the CloudNativePG certificates documentation.