重庆思庄Oracle、KingBase、PostgreSQL、Redhat认证学习论坛

标题: PG16配置单向SSL连接 [打印本页]

作者: 郑全 时间: 2025-7-5 19:11
标题: PG16配置单向SSL连接
1.概念
单向认证 SSL 协议不需要客户拥有CA证书，服务器端不会验证客户证书，以及在协商对称密码方案，对称通话密钥时，服务器发送给客户的是没有加过密的(这并不影响 SSL 过程的安全性)密码方案。
2.PG编译时加上OPENSSL
./configure --with-openssl

后续可以验证
$ pg_config|grep -i openssl
CONFIGURE =  '--prefix=/pg16/soft' '--with-openssl' '--with-pgport=5666'

3.设置SSL选项
  ssl =on
  ssl_cert_file=server.crt
  ssl_key_file=server.key

4.生成服务器端证书及密钥
openssl req -new -x509 -days 365 -nodes -text -out server.crt -keyout server.key -subj "/CN=postgres.com"

chmod 600 server.key

5.增加sslinfo插件
  postgres> create extension sslinfo;

  postgres=# \dx sslinfo
               List of installed extensions
  Name | Version | Schema |          Description
---------+---------+--------+------------------------------------
sslinfo | 1.2    | public | information about SSL certificates
(1 row)

6.重启生效
  pg_ctl restart

7.配置pg_hba
  ...
  hostssl all all 0.0.0.0/0 scram-sha-256
8.配置生效
  pg_ctl reload

9.测试登录
  $ psql postgres://postgres@pg01:5666/postgres?sslmode=require
psql (16.3)
SSL connection (protocol: TLSv1.3, cipher: TLS_AES_256_GCM_SHA384, compression: off)
Type "help" for help.

postgres=# show ssl
;
ssl
-----
on
(1 row)

postgres=# SELECT * FROM pg_stat_ssl WHERE pid = pg_backend_pid();
  pid  | ssl | version |       cipher       | bits | client_dn | client_serial | issuer_dn
-------+-----+---------+------------------------+------+-----------+---------------+-----------
29321 | t | TLSv1.3 | TLS_AES_256_GCM_SHA384 |  256 |          |             |
(1 row)

postgres=# select ssl_is_used();
ssl_is_used
-------------
t
(1 row)

欢迎光临重庆思庄Oracle、KingBase、PostgreSQL、Redhat认证学习论坛 (http://bbs.cqsztech.com/)