PostgreSQL SSL启用与CA证书生成、配置

2019独角兽企业重金招聘Python工程师标准>>>

ref： https://yq.aliyun.com/articles/14965

 

PG服务器配置SSL证书验证

在CA服务器(测试中与PG服务器同一台)

1.生成CA私钥证书（此处名为trustly-ca.key）

su - root

mkdir -p /opt/ssl/private

openssl genrsa -des3 -out /etc/ssl/private/trustly-ca.key 2048 
#需两次输入密码，测试时输入postgres，生成文件trustly-ca.key

chown root:root /opt/ssl/private/trustly-ca.key
chmod 400 /opt/private/trustly-ca.key

#查看私钥属性和内容
file /opt/ssl/private/trustly-ca.key 
/opt/ssl/private/trustly-ca.key: PEM RSA private key

cat /opt/ssl/private/trustly-ca.key 

2.生成CA公共证书（此处名为trustly-ca.crt）

mkdir -p /opt/ssl/share/ca-certificates

openssl req -new -x509 -days 3650 \
> -subj '/C=CN/ST=Zhejiang/L=Hangzhou/O=Skymobi/CN=trustly' \
> -key /etc/ssl/private/trustly-ca.key \
> -out /opt/ssl/share/ca-certificates/trustly-ca.crt
   Enter pass phrase for /opt/ssl/private/trustly-ca.key: 输入私钥的pass phrase: postgres

查看公共证书属性和内容
file /opt/ssl/share/ca-certificates/trustly-ca.crt
   /opt/ssl/share/ca-certificates/trustly-ca.crt: PEM certificate

cat /opt/ssl/share/ca-certificates/trustly-ca.crt

在PG服务器

3.生成PG服务器私钥

在PG服务器PGDATA目录生成证书文件：

server.key
server.crt
root.crt #containing the CA for the server certificate, plus your client certificate (postgresql.crt)