Is there a way to create a Cloud SQL Postgres instance that Enforces SSL/TLS, but that does not require the use of client certificates? In
pg_hba.conf, this would be a line containing
hostssl but not
I have tried Enforcing SSL/TLS (
settings.ipConfiguration.requireSsl on the instance, or
gcloud sql instances patch [INSTANCE_NAME] --require-ssl) But this option seems pretty useless, because:
- According to Managing your client certificates , you can only create “up to 10 client certificates for each instance.” This means that we would have to share the same client certificate/private keys among multiple users or services, so the secret is not truly secret among our employees.
- After presenting a client
psql, postgres still asks for a password. This is evidence that the Cloud SQL
sslCertsAPI inserts a
clientcert=1auth-option, as opposed to a
pg_hba.conf. This means that each client needs both a client cert and a password.