How to specify a client certificate to psql?

Question

I have a Postgres server with a user dev which requires a client certificate to log in. I'm using the command psql "sslmode=require user=dev host=db.prod", which gives me psql: FATAL: connection requires a valid client certificate.

I know where the certificate is on my server. My question is, how do I specify the client certificate location to psql?

Solution 1

As stated in the documentation linked by @Milen, you can do this by setting the PGSSLCERT and PGSSLKEY environment variables, or by adding sslcert=<cert location> sslkey=<key location> to the connection string.

Solution 2

The end result looks like $>psql "port=5431 host=localhost user=postgres sslcert=./test/client.crt sslkey=./test/client.key sslrootcert=./test/server.crt sslmode=verify-ca"

All the variables are here.

Comments

[Federico Sierra]

See howtoforge.com/postgresql-ssl-certificates

[Milen A. Radev]

postgresql.org/docs/current/static/…

[Seldom 'Where's Monica' Needy]

I'll note here that PGSSLCERT and PGSSLKEY also allow paths to be specified, so don't cat the certificate or key itself into those variables.

[Radu Simionescu]

if I place root crt in ~/.postgreqsl/ I don't have to provide any key. If I place it somewhere else and provide sslrootcert, suddenly I have to also provide key - do you know how does that work?