Postgresql无法接受SSL连接：sslv3警报证书未知

Question

I'm using SpringBoot with configuration datasource.url = jdbc:postgresql://...../mydb?ssl=true&sslFactory=....nonValidating...

in my application.yml

port: 8443
ssl:
 enabled: true
 key-alias: PGSQLServerHostNameHere
 key-store: keystore.jks
 key-store-password:....
 key-store-type: JKS
 trust-store: #this one is irrelevant, it's just a...
 ### ... trust store for other restTemplate stuff
 trust-store-password: ....
 key-password: ....
 ciphers: "TLSv1.2"
 protocol: TLS

However, Postgresql also is setup and running with SSL=on. ssl_ciphers='TLSv1.2'

However in PGSQL logs I get:

Postgresql could not accept SSL connection: sslv3 alert certificate unknown

I get an error in my spring boot app on prod (this error doesn't happen with my self-signed cert in local):

org.postgresql...PSQLException: SSL error: sun.security.validator.ValdiatorException: PKIX path building failed:
sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

SSL Cert Configs

I have the signed certificates in root.crt for postgresql server (including the Java app server's signed certificate inside with the right alias).

I have the signed certificate of the postgresql server (alias: PGSQLServerHostNameHere) in the JKS file as a "trustEntry" for my keystore.jks.

I have privateKeyEntry in my keystore.jks for my own server.

I have the root CAs in the keystore.jks.

The SpringBoot app works fine in my local machine with a self-signed JKS.

But Postgresql is a problem... rejecting my communications from the java app server.

postgresql.conf:

ssl = on
ssl_ciphers = 'TLSv1.2'

(everything else is default)

pg_hba.conf

hostssl all all md5

Answer 1

 Postgresql could not accept SSL connection: sslv3 alert certificate unknown .... sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target 

This means that the client could not accept the certificate from the server, probably because the CA which issued that certificate is not in the trust store. And the client sends this server this problem as alert so that the server knows why the connection fails.

But Postgresql is a problem... rejecting my communications from the java app server.

No, your Java application is rejecting the communication with Postgresql because it does not trust the certificate. What you see in the error message from Postgresql is just what your Java application has send as the reason why it will not continue with the TLS handshake.

Answer 2

I guess the only way was to look at JSSE implementation and add -Djavax.net.ssl type commands to command-line or to add it to System.setProperty() .

Additionally, you can add it to the url of the JDBC ssl_cert=... &ssl_key=... etc.

Had to find the right commands for postgresql. It's not well-documented.

the application.yml "ssl" properties are unrelated to javax.net.ssl