We recommend that you use a TLS certificate to authenticate the PostgreSQL server. You can use a certificate from a trusted certification authority (CA) or a self-signed certificate. Use a certificate from a trusted CA because a self-signed certificate provides only limited protection.
Administration Server supports both one-way and two-way SSL authentication for PostgreSQL.
Follow these steps to configure SSL authentication for PostgreSQL:
In an OpenSSL-based cross-platform utility, execute the following commands:
openssl req -new -x509 -days 365 -nodes -text -out psql.crt -keyout psql.key -subj "/CN=psql"
chmod og-rwx psql.key
Run the following commands. The CN value should match the name of the user that connects to PostgreSQL on behalf of the Administration Server. The username is set to postgres by default.
openssl req -new -x509 -days 365 -nodes -text -out postgres.crt -keyout postgres.key -subj "/CN=postgres"
chmod og-rwx postgres.key
Modify pg_hba.conf as follows:
hostssl all all 0.0.0.0/0 md5
Ensure that pg_hba.conf doesn't include a record that starts with host
.
Run the following command:
systemctl restart postgresql-14.service