PostgreSQL JDBC SSL

Question

We have a remote PostgreSQL DB server which requires SSL certs to be provided to connect to it.

I have the following certs with me.

root.pem
intermediate.pem
private-chain.pem
public-chain.pem
certificate.cer
certificate.key

And I am able to connect to the remote database using psql as

psql "port=5432 host=remote-host user=username sslcert=public-chain.pem sslkey=certificate.key dbname=database sslmode=require"

Now, I need to connect to the same database from a Java Spring based Rest API . So, ideally this would require building keystrokes from the certs and using that to connect to the the db.

The issue is, I'm not able to! I've tried all combinations of cert, public-chain, private-chain, root ca, etc. in the keystore. And I've tried passing the keystore as JVM arguments when calling the jar file ( -Djavax.net.ssl.trustStore -Djavax.net.ssl.trustStorePassword -Djavax.net.ssl.keyStore -Djavax.net.ssl.keyStorePassword ).

I've also tried pointing to the keystrokes from PostgreSQL JDBC connection string ( jdbc:postgresql://remote-host:5432/database?ssl=true&sslcert='filename'&sslkey='key' ). Not really sure if this is the right way.

But I keep getting this error.

Caused by: org.postgresql.util.PSQLException: FATAL: connection requires a valid client certificate
    at org.postgresql.core.v3.ConnectionFactoryImpl.doAuthentication(ConnectionFactoryImpl.java:473) ~[postgresql-42.2.2.jar!/:42.2.2]
    at org.postgresql.core.v3.ConnectionFactoryImpl.openConnectionImpl(ConnectionFactoryImpl.java:205) ~[postgresql-42.2.2.jar!/:42.2.2]
    at org.postgresql.core.ConnectionFactory.openConnection(ConnectionFactory.java:49) ~[postgresql-42.2.2.jar!/:42.2.2]
    at org.postgresql.jdbc.PgConnection.<init>(PgConnection.java:195) ~[postgresql-42.2.2.jar!/:42.2.2]
    at org.postgresql.Driver.makeConnection(Driver.java:452) ~[postgresql-42.2.2.jar!/:42.2.2]
    at org.postgresql.Driver.connect(Driver.java:254) ~[postgresql-42.2.2.jar!/:42.2.2]

I am not able to figure out why it works with psql and not with jdbc.

EDIT 1:

Currently I am trying the following approach. This is the spring datasource configuration

spring.datasource.url=jdbc:postgresql://remote-host:5432/database?ssl=true&sslfactory=org.postgresql.ssl.NonValidatingFactory
spring.datasource.username=username

This is the cert config

export PGSSLCERT=/tmp/client.cer 
export PGSSLKEY=/tmp/client.key
export PGSSLMODE=allow

I've also followed the steps described here to trust root ca. But I guess that is not necessary since I'm using org.postgresql.ssl.NonValidatingFactory

And I'm starting the application as

java -jar -Dspring.profiles.active=prod application.jar

Any insights into this are appreciated! Thanks.

Answer 1

What does your pb_hba.conf setting look like?

The JDBC driver only supports the trust, ident, password, md5, and crypt authentication methods.

So your java app will have to connect using password and certificate. You can specify that in your pb_hba.conf:

hostssl all all 0.0.0.0/0 md5 clientcert=1