I'm using SpringBoot with configuration datasource.url = jdbc:postgresql://...../mydb?ssl=true&sslFactory=....nonValidating...
in my application.yml
port: 8443
ssl:
enabled: true
key-alias: PGSQLServerHostNameHere
key-store: keystore.jks
key-store-password:....
key-store-type: JKS
trust-store: #this one is irrelevant, it's just a...
### ... trust store for other restTemplate stuff
trust-store-password: ....
key-password: ....
ciphers: "TLSv1.2"
protocol: TLS
However, Postgresql also is setup and running with SSL=on. ssl_ciphers='TLSv1.2'
However in PGSQL logs I get:
Postgresql could not accept SSL connection: sslv3 alert certificate unknown
I get an error in my spring boot app on prod (this error doesn't happen with my self-signed cert in local):
org.postgresql...PSQLException: SSL error: sun.security.validator.ValdiatorException: PKIX path building failed:
sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
SSL Cert Configs
I have the signed certificates in root.crt for postgresql server (including the Java app server's signed certificate inside with the right alias).
I have the signed certificate of the postgresql server (alias: PGSQLServerHostNameHere) in the JKS file as a "trustEntry" for my keystore.jks.
I have privateKeyEntry in my keystore.jks for my own server.
I have the root CAs in the keystore.jks.
The SpringBoot app works fine in my local machine with a self-signed JKS.
But Postgresql is a problem... rejecting my communications from the java app server.
postgresql.conf:
ssl = on
ssl_ciphers = 'TLSv1.2'
(everything else is default)
pg_hba.conf
hostssl all all md5
Postgresql could not accept SSL connection: sslv3 alert certificate unknown .... sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
This means that the client could not accept the certificate from the server, probably because the CA which issued that certificate is not in the trust store. And the client sends this server this problem as alert so that the server knows why the connection fails.
But Postgresql is a problem... rejecting my communications from the java app server.
No, your Java application is rejecting the communication with Postgresql because it does not trust the certificate. What you see in the error message from Postgresql is just what your Java application has send as the reason why it will not continue with the TLS handshake.
I guess the only way was to look at JSSE implementation and add -Djavax.net.ssl type commands to command-line or to add it to System.setProperty().
Additionally, you can add it to the url of the JDBC ssl_cert=... &ssl_key=... etc.
Had to find the right commands for postgresql. It's not well-documented.
the application.yml "ssl" properties are unrelated to javax.net.ssl