Wiki / Authentication Methods / Authentication and access control
cert
Authenticate using SSL client certificates. See Section 20.12 for details.
Reading PostgreSQL 18.6.
Description
Authenticate using SSL client certificates. See Section 20.12 for details.
- Method
- cert
- Configuration
- pg_hba.conf
- Inventory
- User-visible source authentication method
Documented method options and alternatives
| Option or term | Meaning |
|---|---|
| map | Allows for mapping between system and database user names. See Section 20.2 for details. |
Manual definition
20.12. Certificate Authentication
This authentication method uses SSL client certificates to perform authentication. It is therefore only available for SSL connections; see Section 18.9.2 for SSL configuration instructions. When using this authentication method, the server will require that the client provide a valid, trusted certificate. No password prompt will be sent to the client. The cn (Common Name) attribute of the certificate will be compared to the requested database user name, and if they match the login will be allowed. User name mapping can be used to allow cn to be different from the database user name.
The following configuration options are supported for SSL certificate authentication:
map-
Allows for mapping between system and database user names. See Section 20.2 for details.
It is redundant to use the clientcert option with cert authentication because cert authentication is effectively trust authentication with clientcert=verify-full.
Documentation and source
Source build
- Version
- 18.6
- Build
- https://ftp.postgresql.org/pub/source/v18.6/postgresql-18.6.tar.bz2
- Source fingerprint
555610c24d53e4316da5b7d3fc25c279d96856d5e0e23ee308c328c5fa881d9f
Compare versions
PostgreSQL 17 → 18: unchanged.
Compares recorded interfaces and attributes. Source fingerprints and build metadata are excluded; an absent sample is not proof of the introduction or removal release.
Related entries
Export JSON · Back to Authentication Methods · Recorded in PostgreSQL 10 through 20; the first sample is not necessarily its introduction.