How do I connect with verify-full
?
You first need to figure out the server certificate's CN:
$ psql -h xx.yyy.xx.yyy -U postgres sslmode=verify-full
psql: error: connection to server at "xx.yyy.xx.yyy", port 5432 failed: server certificate for "31-0628fb91-0e3b-4c89-adca-ad557023a699.europe-central2.sql.goog" (and 1 other name) does not match host name "xx.yyy.xx.yyy"
Then you can connect:
$ psql -U postgres 'sslmode=verify-full hostaddr=xx.yyy.xx.yyy host=xx-xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx.europe-central2.sql.goog'
Password for user postgres:
psql (15.4, server 11.19)
SSL connection (protocol: TLSv1.3, cipher: TLS_AES_256_GCM_SHA384, compression: off)
Type "help" for help.
postgres=>
I don't know other ways to figure it out (the CN) other than by using this trick. As such, it doesn't seem like you're supposed to use verify-full
or that it makes any sense. The documentation suggests that verify-full
at least not significantly better than verify-ca
.
What does this mean?
With a local CA only authorized people can obtain a certificate, as such no unauthorized person can fake the target server.
If the CA is local, verify-ca == verify-full
(no eavesdropping, no MITM)?
verify-ca != verify-full
, but supposedly there's not much difference in terms of security. Particularly no MITMs should be possible.
Example of configuring SSL/TLS can be found here.