Configuring the Client

There are a number of connection parameters for configuring the client for SSL. To know more about the SSL Connection parameters and Additional Connection Properties, refer to Section 5.2.

In this section, we will discuss more about the behavior of ssl connection parameter when passed with different values. When you pass the connection parameter ssl=true into the driver, the driver validates the SSL certificate and verifies the hostname. On contrary to this behavior, using libpq defaults to a non-validating SSL connection.

You can get better control of the SSL connection using the sslmode connection parameter. This parameter is the same as the libpq sslmode parameter and the existing SSL implements the following sslmode connection parameters.

sslmode Connection Parameters

sslmode=require

This mode makes the encryption mandatory and also requires the connection to fail if it can’t be encrypted. The server is configured to accept SSL connections for this Host/IP address and that the server recognizes the client certificate.

Note

In this mode, the JDBC driver accepts all server certificates.

sslmode=verify-ca

If sslmode=verify-ca, the server is verified by checking the certificate chain up to the root certificate stored on the client.

sslmode=verify-full

If sslmode=verify-full, the server host name is verified to make sure it matches the name stored in the server certificate. The SSL connection fails if the server certificate cannot be verified. This mode is recommended in most security-sensitive environments.

In the case where the certificate validation is failing you can try sslcert= and LibPQFactory will not send the client certificate. If the server is not configured to authenticate using the certificate it should connect.

The location of the client certificate, client key and root certificate can be overridden with the sslcert, sslkey, and sslrootcert settings respectively. These default to /defaultdir/postgresql.crt, /defaultdir/postgresql.pk8, and /defaultdir/root.crt respectively where defaultdir is ${user.home}/.postgresql/ in unix systems and %appdata%/postgresql/ on windows.

In this mode, when establishing a SSL connection the JDBC driver will validate the server’s identity preventing “man in the middle” attacks. It does this by checking that the server certificate is signed by a trusted authority, and that the host you are connecting to, is the same as the hostname in the certificate.