Navigation:  Pre-required activities > Database configuration >

PostgreSQL - TLS

 Previous  Top  Next

This section will display the configuration procedure for TLS certificates in PostgreSQL.

 

This optional procedure works to enable the TLS certificate with PGSQL when SoftExpert Suite is being installed, both in Windows Server and in Linux.

SSL/TLS connections work as a security layer encrypting data that moves between the client and a database instance. The use of a server certificate provides an extra security layer, validating whether the connection is made along the database instance.

 

To obtain the certificate, it is first necessary to purchase a digital certificate. Once done, the issuing unit will disclose it.

 

To configure the TLS certificate in PostgreSQL, perform the following steps:

 

1.Access the database server that will be used and check the following parameters in the <postgresql_installation_directory>/data/postgresql.conf file:

sudo vi <postgresql_installation_directory>/data/postgresql.conf

ssl = on

ssl_ca_file = ‘<client_certificate.crt>’

ssl_cert_file = ‘<server_certificate.crt>’

ssl_key_file = ‘<certificate_key_server.key>’

 

Given that:

▪<client_certificate.crt>: The certificate signed by the CA used in the application to connect to the database.

▪<server_certificate.crt>: The database certificate.

▪<server_certificate_key.key>: The database certificate key.

Make sure all certificate files are in the <postgresql_installation_directory>/data folder.

 

2.Execute the following commands to add permissions to the files:

sudo chmod 400 <server_certificate.key>

sudo chown postgres.postgres <server_certificate.key>

 

3.Add the following row to the <postgresql_installation_directory>data/pg_hba.conf file:

hostssl all all 0.0.0.0/0 md5

 

4.Restart the PostgreSQL service.

sudo /etc/init.d/postgresql restart

 

5.Access the application server and insert the <client_certificate.crt> in the /usr/local/se/cert path.

 

6.Execute the procedure to configure the equalization. On Linux, it is necessary to create the tag in the database_config.xml file:

sudo vi /usr/local/se/conf/database_config.xml

<certificate>/usr/local/se/cert/<client_certificate.crt></certificate>

 

7.Once done, edit the hosts file by entering the database IP with the server name and the certificate domain:

sudo vi /etc/hosts

<databaseip> <databasedns>.softexpert.com

 

8.Equalize the database and the configuration will be ready!

 

▪For further information on using the SSL/TLS certificate, access: https://www.postgresql.org/docs/12/ssl-tcp.html

▪If it is not in accordance with the database version, check which version is the corresponding one.