SSL-TLS加密连接

1. 配置SSL

# postgresql.conf
ssl = on
ssl_ca_file = '/etc/postgresql/root.crt'
ssl_cert_file = '/etc/postgresql/server.crt'
ssl_key_file = '/etc/postgresql/server.key'

2. 强制SSL

# pg_hba.conf
hostssl all all 0.0.0.0/0 md5       -- 只允许SSL连接
hostnossl all all 0.0.0.0/0 reject   -- 拒绝非SSL连接

3. 客户端证书验证

# pg_hba.conf
hostssl all all 0.0.0.0/0 cert       -- 要求客户端证书

# 客户端连接
psql "host=server dbname=mydb user=alice sslmode=verify-full sslcert=client.crt sslkey=client.key sslrootcert=root.crt"

4. sslmode 选项