May 2019
Intermediate to advanced
600 pages
20h 46m
English
For testing purposes, or for setting up a single trusted user, you can use a self-signed certificate:
openssl genrsa 2048 > client.keyopenssl req -new -x509 -key server.key -out client.crt
In the server, set up a line in the pg_hba.conf file with the hostssl method and the clientcert option set to 1:
hostssl all all 0.0.0.0/0 md5 clientcert=1
Put the client root certificate in the root.crt file in the server data directory ($PGDATA/root.crt). This file may contain multiple trusted root certificates.
If you are using a central certificate authority, you probably also have a certificate revocation list, which should be put in a root.crl file and regularly updated.
In the client, put the client's private key and certificate in ...
Read now
Unlock full access