CODEWITHSUNDEEP
postgresqlssl
EMulligan
EMulligan

Reputation: 23

Postgres: How to verify which certificate is being used for SSL

On a Linux host, when I run the command psql --set=sslmode=verify-full -h (rest of connection command...) I connect to my postgres DB successfully. It also print information on the SSL connection cipher when my psql session begins. What confuses me is I can't figure out how the certificate used is being specified as I'm not listing any in my psql command. https://www.postgresql.org/docs/9.2/libpq-connect.html implies it defaults to stuff in a ~/.postgresql folder, but I don't have such a folder currently. I've seen references to environment variables like PGSSLROOTCERT mentioned elsewhere, but I don't have those set.

How do I determine which SSL certificate is being used? If it matters this is for a connection to an AWS RDS database.

Upvotes: 1

Views: 4032

Answers (1)

jjanes
jjanes

Reputation: 44413

psql --set=sslmode=verify-full -h ...

This sets a "psql" variable named sslmode. This variable makes no difference to anything. So you are not actually doing verification of the server's cert.

Try setting sslmode in a supported way, like:

PGSSLMODE=verify-full psql -h ...

or 

psql sslmode=verify-full -h ...

(But if you use this last one, then you cannot have a -d option hiding in the ...)

Upvotes: 2

Related Questions