如何使用 OpenSSL 为 Postgresql DB 的多个用户创建客户端证书？

Question

In my database environment (Postgresql 13 on Oracle Linux 8), i can create a client certificate for specific postgresql db user as below:

openssl req -new -nodes -out client.csr \
  -keyout keys/client.key -subj "/CN={db_username}"

Though it's working for one username, i wonder if multiple usernames or wildcards can be used. For example, can it be used like :

CN=user1,user2,user3 

or something similar?

Answer 1

No, but as the documentation describes, you can use a map in the pg_ident.conf file:

User name mapping can be used to allow cn to be different from the database user name.

So you could use one certificate (with a single name) for several database users.

As an example, the line in pg_hba.conf could look like

# TYPE  DATABASE  USER   ADDRESS         METHOD
host    mydb      user1  12.34.56.78/32  cert map=mymap
host    mydb      user2  12.34.56.78/32  cert map=mymap
host    mydb      user3  12.34.56.78/32  cert map=mymap

Then pg_ident.conf might look like

# MAPNAME  SYSTEM-USERNAME   PG-USERNAME
mymap      certuser          user1
mymap      certuser          user2
mymap      certuser          user3

Here, certuser is the common name in the certificate.

Answer 2

After giving it lots of tries, i found out that my connection doesn't care about the CN at my client certificate if i configure pg_hba.conf like this:

hostssl    all    all    192.168.1.34/32    scram-sha-256     clientcert=1

This way, connection can be established as long as required key and certificates are available. In addition, passwords will be required so that makes the connection secure.