ssl_ca_file

Definition PG 18 manual

Specifies the name of the file containing the SSL server certificate authority (CA). Relative paths are relative to the data directory. This parameter can only be set in the postgresql.conf file or on the server command line. The default is empty, meaning no CA file is loaded, and client certificate verification is not performed.

How it works

ssl_ca_file identifies the location of the SSL certificate authority file. The PEM CA bundle defines trust roots for client-certificate verification and the acceptable-authority list sent during TLS negotiation.

ssl_ca_file is a SIGHUP-context setting: a configuration reload activates the new server value without a restart; subsequent operations that consult it use the refreshed value. Existing TLS sessions are not renegotiated.

It participates in the TLS context used for new handshakes. ssl enables transport, pg_hba.conf decides which connection classes require it, and the certificate, key, CA, revocation, protocol, and cipher settings must form one valid policy.

Operational considerations

Editing ssl_ca_file without reloading configuration and verifying the effective value and subsequent behavior.

Updating only one TLS file or policy knob and leaving an invalid chain, unreadable key, or incompatible protocol set.

Assuming a reload renegotiates existing sessions; TLS policy changes affect new handshakes.

Changing ssl_ca_file globally without a rollback plan and a client or operational compatibility test.

Workload guidance

OLAP: Analytical access uses the same trust roots unless it is a deliberately separate PKI realm. Do not broaden the CA bundle to solve a client deployment problem.

OLTP: Use ssl_ca_file only for a reviewed CA bundle that is intended to validate client certificates. Plan overlapping trust roots during CA rotation, restrict file writes, and test every cert/clientcert HBA path after reload.

SMALL: Leave it empty when client-certificate verification is not used. If enabled, keep the bundle minimal, monitored for expiry, and identical on failover nodes.