连接需要 laravel 谷歌云 postgres 中的有效客户端证书与 ssl 模式

Question

I am facing a issue when trying to connect to gcloud postgres db allowing ssl in my laravel application which is running in the cloud run. I downloaded all three cert files from gcloud and set the path in config/database.php.

            'driver' => 'pgsql',
            'host' => env('DB_HOST', '127.0.0.1'),
            'port' => env('DB_PORT', '5432'),
            'database' => env('DB_DATABASE', 'forge'),
            'username' => env('DB_USERNAME', 'forge'),
            'password' => env('DB_PASSWORD', ''),
            'unix_socket' => env('DB_SOCKET', ''),
            'charset' => 'utf8',
            'prefix' => '',
            'schema' => 'public',
            'sslmode' => 'require',
            'options' => [
               'sslcert' => storage_path(path: 'client-cert.pem'),
               'sslkey' => storage_path(path: 'client-key.pem'),
               'sslrootcert' => storage_path(path: 'server-ca.pem'),
            ],
        ],```
after enabling the 'Allow only SSL connections' I am getting this error.
'SQLSTATE[08006] [7] FATAL: connection requires a valid client certificate (SQL: select * from "sessions" where "id" = wDJOd7Ssm6ggLngYQPprlIP0FNrtMxGTtCW4lELX limit 1)'

I can successfully connect to the same db via pgadmin and psql console with ssl certificates from my local machine(windows). But I need to do it through my application. Please help me to overcome this as it is showing as a high security risk factor in the GCP Security Command Center.
Thanks.

Answer 1

There are at least two possible problems:

ITEM 1:

You have 'sslmode' => 'require' . This means that the server certificate is validated against the CA. For Google Cloud SQL, the server's certificate contains the name of the Cloud SQL instance which does not match the hostname.

Change the value to allow . Google Cloud SQL will enforce client certificates. The PostgresQL client will not validate the server's certificate which will fail if validated.

ITEM 2:

The certificates are invalid. Open each one in a text editor and verify that they are text files with proper headers:

client_cert.pem: -----BEGIN CERTIFICATE----- client_key.pem: -----BEGIN RSA PRIVATE KEY----- server-ca.pem: -----BEGIN CERTIFICATE-----

You can also use openssl to verify the files.