I have a Postgres server with a user dev which requires a client certificate to log in. I'm using the command psql "sslmode=require user=dev host=db.prod", which gives me psql: FATAL: connection requires a valid client certificate.

I know where the certificate is on my server. My question is, how do I specify the client certificate location to psql?


The end result looks like $>psql "port=5431 host=localhost user=postgres sslcert=./test/client.crt sslkey=./test/client.key sslrootcert=./test/server.crt sslmode=verify-ca"

All the variables are here.

| improve this answer | |
  • if I place root crt in ~/.postgreqsl/ I don't have to provide any key. If I place it somewhere else and provide sslrootcert, suddenly I have to also provide key - do you know how does that work? – Radu Simionescu Sep 11 '18 at 16:58

As stated in the documentation linked by @Milen, you can do this by setting the PGSSLCERT and PGSSLKEY environment variables, or by adding sslcert=<cert location> sslkey=<key location> to the connection string.

| improve this answer | |
  • 2
    I'll note here that PGSSLCERT and PGSSLKEY also allow paths to be specified, so don't cat the certificate or key itself into those variables. – SeldomNeedy Jun 3 '16 at 21:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.