Using psql to connect to PostgreSQL in SSL mode

Question

I am trying to configure ssl certificate for PostgreSQL server. I have created a certificate file (server.crt) and key (server.key) in data directory and update the parameter SSL to "on" to enable secure connection.

I just want only the server to be authenticated with server certificates on the client side and don't require the authenticity of client at server side. I am using psql as a client to connect and execute the commands.

I am using PostgreSQL 8.4 and Linux. I tried with the below command to connect to server with SSL enabled

       psql "postgresql://localhost:2345/postgres?sslmode=require"

but I am getting

       psql: invalid connection option "postgresql://localhost:2345/postgres?sslmode"

What am doing wrong here? Is the way I am trying to connect to server with SSL mode enabled is correct? Is it fine to authenticate only server and not the client ?

Answer 1

psql below 9.2 does not accept this URL-like syntax for options.

The use of SSL can be driven by the sslmode=value option on the command line or the PGSSLMODE environment variable, but the default being prefer , SSL connections will be tried first automatically without specifying anything.

Example with a conninfo string ( updated for psql 8.4 )

psql "sslmode=require host=localhost dbname=test"

Read the manual page for more options.

Answer 2

psql --set=sslmode=require -h localhost -p 2345 -U thirunas \
-d postgres -f test_schema.ddl

Another Example for securely connecting to Azure's managed Postgres database:

psql --file=product_data.sql --host=hostname.postgres.database.azure.com --port=5432 \
--username=postgres@postgres-esprit --dbname=product_data \
--set=sslmode=verify-full --set=sslrootcert=/opt/ssl/BaltimoreCyberTrustRoot.crt.pem

Answer 3

发现以下选项可用于为自签名 postgres 实例提供所有文件

psql "host={hostname} sslmode=prefer sslrootcert={ca-cert.pem} sslcert={client-cert.pem} sslkey={client-key.pem} port={port} user={user} dbname={db}"

Answer 4

On psql client v12, I could not find option in psql client to activate sslmode=verify-full .

I ended up using environment variables :

PGSSLMODE=verify-full PGSSLROOTCERT=server-ca.pem psql -h your_host -U your_user -W -d your_db

Answer 5

psql "sslmode=require host=localhost port=2345 dbname=postgres" --username=some_user

根据postgres psql 文档，只有连接参数应该放在 conninfo 字符串中（这就是为什么在我们的示例中，--username 不在该字符串中）

Answer 6

好吧，如果连接需要在 SSL 模式下，则您云在 CLI 中使用以下命令提供所有信息：

psql "sslmode=verify-ca sslrootcert=server-ca.pem sslcert=client-cert.pem sslkey=client-key.pem hostaddr=your_host port=5432 user=your_user dbname=your_db" 

Answer 7

psql -h <host> -p <port> -U <user> -d <db>

and update /var/lib/pgsql/10/data/pg_hba.conf to change the auth method to cert . Check the following link for more information:

https://www.postgresql.org/docs/9.1/auth-pg-hba-conf.html

Answer 8

Another pattern that worked with v8 is

psql -h host_name -p port -U user_name "dbname=db sslmode=require"