PostgreSQL sslmode enabled

[micheelengronne]

CFSSL used as a CA can have a PostgreSQL backend.

There is no example using the sslmode functionality of PostgreSQL. As it is the backend of the CA it should be the perfect place to use it.

Does it work ? Should it be implemented ?

[Roydon]

It failed for me, then this worked

    {
    	"driver": "postgres",
    	"data_source": "postgres://${username}:${password}@${host}/${database}?sslmode=disable"
    }

[micheelengronne]

But that's exactly what I do not want. I want to enable ssl.

[krish7919]

@micheelengronne

In the above example, if you use instead of

	"data_source": "postgres://${username}:${password}@${host}/${database}?sslmode=disable"

something like

	"data_source": "postgres://${username}:${password}@${host}/${database}?sslmode=verify-full&sslrootcert=<path to cert>"

this should just work. CFSSL just calls the lib/pq library underneath with the connection string supplied.

The verify-full config option is one way to do this, there are other options to full/partial SSL verification, and you can refer to the Postgres documentation for this.