{"Entry":{"collection":"auth","key":"cert","name":"cert","aliases":[],"metadata":{"aliases":[],"category":"Authentication and access control","content_hash":"297f2685302419b982caafa87769863b919a7a6ae98bc789cda92d789a257042","derived_content_hash":"0c67a13d21dce1e1e5b90a15af64dc4652f2a633271e6d40db37e6319d22ba3d","imported_at":"2026-09-30T00:40:33.271308+08:00","name":"cert","name_zh":"","slug":"cert","summary":"Authenticate using SSL client certificates. See Section 20.11 for details."}},"Definition":{"Collection":"auth","Key":"cert","SourceDatabase":"center","Version":"18","SourceTable":"authentication_method","SourceKey":"cert","SourceRevision":"555610c24d53e4316da5b7d3fc25c279d96856d5e0e23ee308c328c5fa881d9f","Facts":{"aliases":[],"attributes":{"configuration":"pg_hba.conf","inventory":"User-visible source authentication method","method":"cert"},"comparison_data":{"documented_option_names":["map"],"method":"cert"},"comparison_hash":"40542fff8f26666c5c9e9d161e6288daf51bf13f0e269760dbc632420d0e4b94","description":["Authenticate using SSL client certificates. See Section 20.12 for details."],"description_zh":"认证方法 cert。","description_zh_html":"\u003cp\u003e认证方法 cert。\u003c/p\u003e\u003cdl\u003e\u003cdt\u003e索引访问方法\u003c/dt\u003e\u003cdd\u003e\u003ccode\u003ecert\u003c/code\u003e\u003c/dd\u003e\u003cdt\u003e配置\u003c/dt\u003e\u003cdd\u003e\u003ccode\u003epg_hba.conf\u003c/code\u003e\u003c/dd\u003e\u003c/dl\u003e\u003ch3\u003e同版本中文手册节选\u003c/h3\u003e\u003cp\u003e\n    这种认证方法使用 SSL 客户端证书来完成认证。因此，它仅适用于 SSL 连接；关于 SSL 的配置说明，见\u003ca class=\"xref\" href=\"/zh/docs/18/ssl-tcp.html#SSL-OPENSSL-CONFIG\"\u003e第 18.9.2 节\u003c/a\u003e。使用此认证方法时，服务器会要求客户端提供有效且受信任的证书。不会向客户端发送密码提示。证书的 \u003ccode class=\"literal\"\u003ecn\u003c/code\u003e（通用名称）属性将与请求的数据库用户名进行比较，如果它们匹配，则允许登录。用户名映射可用于允许 \u003ccode class=\"literal\"\u003ecn\u003c/code\u003e 与数据库用户名不同。\n\u003c/p\u003e\u003cp\u003e\n    SSL 证书认证支持下列配置选项：\n    \u003c/p\u003e\u003cp\u003e\n    将 \u003ccode class=\"literal\"\u003eclientcert\u003c/code\u003e 选项与 \u003ccode class=\"literal\"\u003ecert\u003c/code\u003e 认证一起使用是多余的，因为 \u003ccode class=\"literal\"\u003ecert\u003c/code\u003e 认证实际上等同于带有 \u003ccode class=\"literal\"\u003eclientcert=verify-full\u003c/code\u003e 的 \u003ccode class=\"literal\"\u003etrust\u003c/code\u003e 认证。\n   \u003c/p\u003e\u003cp\u003e\u003ca href=\"/zh/docs/18/auth-cert.html\"\u003e查看完整中文手册与上下文\u003c/a\u003e。\u003c/p\u003e","facts":[{"label":"Method","value":"cert"},{"label":"Configuration","value":"pg_hba.conf"},{"label":"Inventory","value":"User-visible source authentication method"}],"facts_zh":[{"label":"方法","value":"cert"},{"label":"配置","value":"pg_hba.conf"},{"label":"清单","value":"用户可见的源码认证方法"}],"manual_html":"\u003cdiv class=\"sect1\" id=\"AUTH-CERT\"\u003e\n\u003cdiv class=\"titlepage\"\u003e\n\u003cdiv\u003e\n\u003cdiv\u003e\n\u003ch2 class=\"title\"\u003e20.12. Certificate Authentication \u003c/h2\u003e\n\u003c/div\u003e\n\u003c/div\u003e\n\u003c/div\u003e\n\u003cp\u003eThis authentication method uses SSL client certificates to perform authentication. It is therefore only available for SSL connections; see \u003ca class=\"xref\" href=\"/docs/18/ssl-tcp.html#SSL-OPENSSL-CONFIG\" title=\"18.9.2. OpenSSL Configuration\"\u003eSection 18.9.2\u003c/a\u003e for SSL configuration instructions. When using this authentication method, the server will require that the client provide a valid, trusted certificate. No password prompt will be sent to the client. The \u003ccode class=\"literal\"\u003ecn\u003c/code\u003e (Common Name) attribute of the certificate will be compared to the requested database user name, and if they match the login will be allowed. User name mapping can be used to allow \u003ccode class=\"literal\"\u003ecn\u003c/code\u003e to be different from the database user name.\u003c/p\u003e\n\u003cp\u003eThe following configuration options are supported for SSL certificate authentication:\u003c/p\u003e\n\u003cdiv class=\"variablelist\"\u003e\n\u003cdl class=\"variablelist\"\u003e\n\u003cdt\u003e\u003cspan class=\"term\"\u003e\u003ccode class=\"literal\"\u003emap\u003c/code\u003e\u003c/span\u003e\u003c/dt\u003e\n\u003cdd\u003e\n\u003cp\u003eAllows for mapping between system and database user names. See \u003ca class=\"xref\" href=\"/docs/18/auth-username-maps.html\" title=\"20.2. User Name Maps\"\u003eSection 20.2\u003c/a\u003e for details.\u003c/p\u003e\n\u003c/dd\u003e\n\u003c/dl\u003e\n\u003c/div\u003e\n\u003cp\u003eIt is redundant to use the \u003ccode class=\"literal\"\u003eclientcert\u003c/code\u003e option with \u003ccode class=\"literal\"\u003ecert\u003c/code\u003e authentication because \u003ccode class=\"literal\"\u003ecert\u003c/code\u003e authentication is effectively \u003ccode class=\"literal\"\u003etrust\u003c/code\u003e authentication with \u003ccode class=\"literal\"\u003eclientcert=verify-full\u003c/code\u003e.\u003c/p\u003e\n\u003c/div\u003e","manual_path":"/docs/18/auth-cert.html","related":[],"release":{"catalog_fingerprint":"65c93d6048ef30e61023a84f9680fa6a92b1c383b7eb226741170077eb078502","channel":"stable","label":"18.6","major":"18","ref":"https://ftp.postgresql.org/pub/source/v18.6/postgresql-18.6.tar.bz2","revision":"555610c24d53e4316da5b7d3fc25c279d96856d5e0e23ee308c328c5fa881d9f","source_sha256":"555610c24d53e4316da5b7d3fc25c279d96856d5e0e23ee308c328c5fa881d9f"},"sections":[],"sections_zh":[],"signature":"","sources":[{"label":"Matching PostgreSQL source archive","sha256":"555610c24d53e4316da5b7d3fc25c279d96856d5e0e23ee308c328c5fa881d9f","url":"https://ftp.postgresql.org/pub/source/v18.6/postgresql-18.6.tar.bz2"},{"label":"PostgreSQL 18 English manual","path":"auth-cert.html","sha256":"b43c008f505f9b377b2712eef6c9f98a10a3074642ca173f46e44316305c02ad","url":"/docs/18/auth-cert.html"},{"label":"PostgreSQL 18 English manual","path":"auth-pg-hba-conf.html","sha256":"6340d4abea2e0a3482afc31bcd1599a0fa10dc28a6f1e05d79ba831e2dd0b4c9","url":"/docs/18/auth-pg-hba-conf.html"}],"tables":[{"columns":[{"key":"name","label":"Option or term"},{"key":"description","label":"Meaning"}],"key":"method-options","rows":[{"description":"Allows for mapping between system and database user names. See Section 20.2 for details.","name":"map"}],"title":"Documented method options and alternatives"}],"tables_zh":[{"columns":[{"key":"name","label":"选项或术语"},{"key":"description","label":"含义"}],"key":"method-options","rows":[{"description":"允许在系统用户名和数据库用户名之间进行映射。详见 第 20.2 节 。","name":"map"}],"title":"手册中的方法选项与替代方式"}],"zh_from":{"authored_translation":"source-derived-structured-summary","body_sha256":"8fd0093f4119c3d41012524ab23960b3e9004529e192dbf0e5ba7a428296cfa8","kind":"same-version-chinese-manual-with-source-derived-structured-summary","manual":{"anchor":"","build_id":107,"extraction":"concept-introduction","fragment_sha256":"7956d9783c7a6383bf638eed8b7cca99293787708d580eccb8e544debddc704a","locale":"zh-Hans","page_key":"auth-cert.html","source_hash":"45186c2e05d7481df393c2a9a1b3cb3723f6f50c1b6128138b3cfd7b251c9024","source_revision":"unknown:rendered-translation-baseline","translated_from_revision":null,"translation_revision":"git:b1b500221dbe5437cfca004d6b04d3f6e422765d;html-sha256:08e987a66af27b98444a8057c256314eafa13611a3fb9e888214fc436824244b","url":"/zh/docs/18/auth-cert.html","version":"18"},"runtime_rerun":false,"source_facts_revision":"555610c24d53e4316da5b7d3fc25c279d96856d5e0e23ee308c328c5fa881d9f"}},"ManualEvidence":{"manual_path":"/docs/18/auth-cert.html","release":{"catalog_fingerprint":"65c93d6048ef30e61023a84f9680fa6a92b1c383b7eb226741170077eb078502","channel":"stable","label":"18.6","major":"18","ref":"https://ftp.postgresql.org/pub/source/v18.6/postgresql-18.6.tar.bz2","revision":"555610c24d53e4316da5b7d3fc25c279d96856d5e0e23ee308c328c5fa881d9f","source_sha256":"555610c24d53e4316da5b7d3fc25c279d96856d5e0e23ee308c328c5fa881d9f"},"sources":[{"label":"Matching PostgreSQL source archive","sha256":"555610c24d53e4316da5b7d3fc25c279d96856d5e0e23ee308c328c5fa881d9f","url":"https://ftp.postgresql.org/pub/source/v18.6/postgresql-18.6.tar.bz2"},{"label":"PostgreSQL 18 English manual","path":"auth-cert.html","sha256":"b43c008f505f9b377b2712eef6c9f98a10a3074642ca173f46e44316305c02ad","url":"/docs/18/auth-cert.html"},{"label":"PostgreSQL 18 English manual","path":"auth-pg-hba-conf.html","sha256":"6340d4abea2e0a3482afc31bcd1599a0fa10dc28a6f1e05d79ba831e2dd0b4c9","url":"/docs/18/auth-pg-hba-conf.html"}]},"MeasuredEvidence":{}},"Text":{"Collection":"auth","Key":"cert","SourceDatabase":"center","Version":"18","Locale":"en","Title":"cert","Summary":"Authenticate using SSL client certificates. See Section 20.12 for details.","BodyHTML":"\u003cdiv id=\"AUTH-CERT\"\u003e\n\u003cdiv\u003e\n\u003cdiv\u003e\n\u003cdiv\u003e\n\u003ch2\u003e20.12. Certificate Authentication \u003c/h2\u003e\n\u003c/div\u003e\n\u003c/div\u003e\n\u003c/div\u003e\n\u003cp\u003eThis authentication method uses SSL client certificates to perform authentication. It is therefore only available for SSL connections; see \u003ca href=\"/docs/18/ssl-tcp.html#SSL-OPENSSL-CONFIG\" rel=\"nofollow\"\u003eSection 18.9.2\u003c/a\u003e for SSL configuration instructions. When using this authentication method, the server will require that the client provide a valid, trusted certificate. No password prompt will be sent to the client. The \u003ccode\u003ecn\u003c/code\u003e (Common Name) attribute of the certificate will be compared to the requested database user name, and if they match the login will be allowed. User name mapping can be used to allow \u003ccode\u003ecn\u003c/code\u003e to be different from the database user name.\u003c/p\u003e\n\u003cp\u003eThe following configuration options are supported for SSL certificate authentication:\u003c/p\u003e\n\u003cdiv\u003e\n\u003cdl\u003e\n\u003cdt\u003e\u003cspan\u003e\u003ccode\u003emap\u003c/code\u003e\u003c/span\u003e\u003c/dt\u003e\n\u003cdd\u003e\n\u003cp\u003eAllows for mapping between system and database user names. See \u003ca href=\"/docs/18/auth-username-maps.html\" rel=\"nofollow\"\u003eSection 20.2\u003c/a\u003e for details.\u003c/p\u003e\n\u003c/dd\u003e\n\u003c/dl\u003e\n\u003c/div\u003e\n\u003cp\u003eIt is redundant to use the \u003ccode\u003eclientcert\u003c/code\u003e option with \u003ccode\u003ecert\u003c/code\u003e authentication because \u003ccode\u003ecert\u003c/code\u003e authentication is effectively \u003ccode\u003etrust\u003c/code\u003e authentication with \u003ccode\u003eclientcert=verify-full\u003c/code\u003e.\u003c/p\u003e\n\u003c/div\u003e","SourceRevision":"555610c24d53e4316da5b7d3fc25c279d96856d5e0e23ee308c328c5fa881d9f","ContentHash":"b6ce73929cd44e9c93837be428cde75114ca075182217a2d21e79516cfdd5c5f","Payload":{"description":["Authenticate using SSL client certificates. See Section 20.12 for details."],"manual_html":"\u003cdiv class=\"sect1\" id=\"AUTH-CERT\"\u003e\n\u003cdiv class=\"titlepage\"\u003e\n\u003cdiv\u003e\n\u003cdiv\u003e\n\u003ch2 class=\"title\"\u003e20.12. Certificate Authentication \u003c/h2\u003e\n\u003c/div\u003e\n\u003c/div\u003e\n\u003c/div\u003e\n\u003cp\u003eThis authentication method uses SSL client certificates to perform authentication. It is therefore only available for SSL connections; see \u003ca class=\"xref\" href=\"/docs/18/ssl-tcp.html#SSL-OPENSSL-CONFIG\" title=\"18.9.2. OpenSSL Configuration\"\u003eSection 18.9.2\u003c/a\u003e for SSL configuration instructions. When using this authentication method, the server will require that the client provide a valid, trusted certificate. No password prompt will be sent to the client. The \u003ccode class=\"literal\"\u003ecn\u003c/code\u003e (Common Name) attribute of the certificate will be compared to the requested database user name, and if they match the login will be allowed. User name mapping can be used to allow \u003ccode class=\"literal\"\u003ecn\u003c/code\u003e to be different from the database user name.\u003c/p\u003e\n\u003cp\u003eThe following configuration options are supported for SSL certificate authentication:\u003c/p\u003e\n\u003cdiv class=\"variablelist\"\u003e\n\u003cdl class=\"variablelist\"\u003e\n\u003cdt\u003e\u003cspan class=\"term\"\u003e\u003ccode class=\"literal\"\u003emap\u003c/code\u003e\u003c/span\u003e\u003c/dt\u003e\n\u003cdd\u003e\n\u003cp\u003eAllows for mapping between system and database user names. See \u003ca class=\"xref\" href=\"/docs/18/auth-username-maps.html\" title=\"20.2. User Name Maps\"\u003eSection 20.2\u003c/a\u003e for details.\u003c/p\u003e\n\u003c/dd\u003e\n\u003c/dl\u003e\n\u003c/div\u003e\n\u003cp\u003eIt is redundant to use the \u003ccode class=\"literal\"\u003eclientcert\u003c/code\u003e option with \u003ccode class=\"literal\"\u003ecert\u003c/code\u003e authentication because \u003ccode class=\"literal\"\u003ecert\u003c/code\u003e authentication is effectively \u003ccode class=\"literal\"\u003etrust\u003c/code\u003e authentication with \u003ccode class=\"literal\"\u003eclientcert=verify-full\u003c/code\u003e.\u003c/p\u003e\n\u003c/div\u003e","related":[],"sections":[],"tables":[{"columns":[{"key":"name","label":"Option or term"},{"key":"description","label":"Meaning"}],"key":"method-options","rows":[{"description":"Allows for mapping between system and database user names. See Section 20.2 for details.","name":"map"}],"title":"Documented method options and alternatives"}]}},"RequestedLocale":"en","Fallback":false,"Versions":["10","11","12","13","14","15","16","17","18","19","20"],"Locales":["en","zh-Hans"],"Signatures":null,"Spellings":null,"SQLState":null,"Evidence":null}