{"kind": "auth", "major": "18", "item": {"slug": "cert", "name": "cert", "name_zh": "", "category": "Authentication and access control", "summary": "Authenticate using SSL client certificates. See Section 20.12 for details.", "aliases": [], "content_hash": "297f2685302419b982caafa87769863b919a7a6ae98bc789cda92d789a257042", "versions": {"10": {"facts": [{"label": "Method", "value": "cert"}, {"label": "Configuration", "value": "pg_hba.conf"}, {"label": "Inventory", "value": "User-visible source authentication method"}], "tables": [{"key": "method-options", "rows": [{"name": "map", "description": "Allows for mapping between system and database user names. See Section 20.2 for details."}], "title": "Documented method options and alternatives", "columns": [{"key": "name", "label": "Option or term"}, {"key": "description", "label": "Meaning"}]}], "aliases": [], "related": [], "release": {"ref": "https://ftp.postgresql.org/pub/source/v10.23/postgresql-10.23.tar.bz2", "label": "10.23", "major": "10", "channel": "historical", "revision": "94a4b2528372458e5662c18d406629266667c437198160a18cdfd2c4a4d6eee9", "source_sha256": "94a4b2528372458e5662c18d406629266667c437198160a18cdfd2c4a4d6eee9", "catalog_fingerprint": "691be281b476dde4374d7f805b2bacc2e75bdef40f1e9d3d42e91f97fe95cfd0"}, "sources": [{"url": "https://ftp.postgresql.org/pub/source/v10.23/postgresql-10.23.tar.bz2", "label": "Matching PostgreSQL source archive", "sha256": "94a4b2528372458e5662c18d406629266667c437198160a18cdfd2c4a4d6eee9"}, {"url": "/docs/10/auth-methods.html#AUTH-CERT", "path": "auth-methods.html", "label": "PostgreSQL 10 English manual", "sha256": "856d36a3fdfe8c45a25832e49bd07e9b7480f2ff9a33e58ac7c392630149bc34"}, {"url": "/docs/10/auth-pg-hba-conf.html", "path": "auth-pg-hba-conf.html", "label": "PostgreSQL 10 English manual", "sha256": "04fed609a50e8fd3013ffebb83039c544d39b6c73a6c2b2e23cd7864a70b42da"}], "sections": [], "signature": "", "attributes": {"method": "cert", "inventory": "User-visible source authentication method", "configuration": "pg_hba.conf"}, "description": ["Authenticate using SSL client certificates. See Section 20.3.9 for details."], "manual_html": "
\n
\n
\n
\n

20.3.9.\u00a0Certificate Authentication

\n
\n
\n
\n\n

This authentication method uses SSL client certificates to perform authentication. It is therefore only available for SSL connections. When using this authentication method, the server will require that the client provide a valid, trusted certificate. No password prompt will be sent to the client. The cn (Common Name) attribute of the certificate will be compared to the requested database user name, and if they match the login will be allowed. User name mapping can be used to allow cn to be different from the database user name.

\n

The following configuration options are supported for SSL certificate authentication:

\n
\n
\n
map
\n
\n

Allows for mapping between system and database user names. See Section\u00a020.2 for details.

\n
\n
\n
\n

In a pg_hba.conf record specifying certificate authentication, the authentication option clientcert is assumed to be 1, and it cannot be turned off since a client certificate is necessary for this method. What the cert method adds to the basic clientcert certificate validity test is a check that the cn attribute matches the database user name.

\n
", "manual_path": "/docs/10/auth-methods.html#AUTH-CERT", "comparison_data": {"method": "cert", "documented_option_names": ["map"]}, "comparison_hash": "40542fff8f26666c5c9e9d161e6288daf51bf13f0e269760dbc632420d0e4b94"}, "11": {"facts": [{"label": "Method", "value": "cert"}, {"label": "Configuration", "value": "pg_hba.conf"}, {"label": "Inventory", "value": "User-visible source authentication method"}], "tables": [{"key": "method-options", "rows": [{"name": "map", "description": "Allows for mapping between system and database user names. See Section 20.2 for details."}], "title": "Documented method options and alternatives", "columns": [{"key": "name", "label": "Option or term"}, {"key": "description", "label": "Meaning"}]}], "aliases": [], "related": [], "release": {"ref": "https://ftp.postgresql.org/pub/source/v11.22/postgresql-11.22.tar.bz2", "label": "11.22", "major": "11", "channel": "historical", "revision": "2cb7c97d7a0d7278851bbc9c61f467b69c094c72b81740b751108e7892ebe1f0", "source_sha256": "2cb7c97d7a0d7278851bbc9c61f467b69c094c72b81740b751108e7892ebe1f0", "catalog_fingerprint": "8f21f4444b7f68923f4762af0eb7937fa2907026e91249483e79050de012c901"}, "sources": [{"url": "https://ftp.postgresql.org/pub/source/v11.22/postgresql-11.22.tar.bz2", "label": "Matching PostgreSQL source archive", "sha256": "2cb7c97d7a0d7278851bbc9c61f467b69c094c72b81740b751108e7892ebe1f0"}, {"url": "/docs/11/auth-cert.html", "path": "auth-cert.html", "label": "PostgreSQL 11 English manual", "sha256": "a2f6ee38ab581914ee2bbdc424832b6c4d1109542449129f4a3f874dc1d3ac9d"}, {"url": "/docs/11/auth-pg-hba-conf.html", "path": "auth-pg-hba-conf.html", "label": "PostgreSQL 11 English manual", "sha256": "5477c61a002171f5b4c462052d91231c405f39d89d825faf71e52fbae358eef7"}], "sections": [], "signature": "", "attributes": {"method": "cert", "inventory": "User-visible source authentication method", "configuration": "pg_hba.conf"}, "description": ["Authenticate using SSL client certificates. See Section 20.12 for details."], "manual_html": "
\n
\n
\n
\n

20.12.\u00a0Certificate Authentication

\n
\n
\n
\n

This authentication method uses SSL client certificates to perform authentication. It is therefore only available for SSL connections; see Section\u00a018.9.2 for SSL configuration instructions. When using this authentication method, the server will require that the client provide a valid, trusted certificate. No password prompt will be sent to the client. The cn (Common Name) attribute of the certificate will be compared to the requested database user name, and if they match the login will be allowed. User name mapping can be used to allow cn to be different from the database user name.

\n

The following configuration options are supported for SSL certificate authentication:

\n
\n
\n
map
\n
\n

Allows for mapping between system and database user names. See Section\u00a020.2 for details.

\n
\n
\n
\n

In a pg_hba.conf record specifying certificate authentication, the authentication option clientcert is assumed to be 1, and it cannot be turned off since a client certificate is necessary for this method. What the cert method adds to the basic clientcert certificate validity test is a check that the cn attribute matches the database user name.

\n
", "manual_path": "/docs/11/auth-cert.html", "comparison_data": {"method": "cert", "documented_option_names": ["map"]}, "comparison_hash": "40542fff8f26666c5c9e9d161e6288daf51bf13f0e269760dbc632420d0e4b94"}, "12": {"facts": [{"label": "Method", "value": "cert"}, {"label": "Configuration", "value": "pg_hba.conf"}, {"label": "Inventory", "value": "User-visible source authentication method"}], "tables": [{"key": "method-options", "rows": [{"name": "map", "description": "Allows for mapping between system and database user names. See Section 20.2 for details."}], "title": "Documented method options and alternatives", "columns": [{"key": "name", "label": "Option or term"}, {"key": "description", "label": "Meaning"}]}], "aliases": [], "related": [], "release": {"ref": "https://ftp.postgresql.org/pub/source/v12.22/postgresql-12.22.tar.bz2", "label": "12.22", "major": "12", "channel": "historical", "revision": "8df3c0474782589d3c6f374b5133b1bd14d168086edbc13c6e72e67dd4527a3b", "source_sha256": "8df3c0474782589d3c6f374b5133b1bd14d168086edbc13c6e72e67dd4527a3b", "catalog_fingerprint": "9f857f4ee4875f9c7de6bfc9df4b757dec8b3a0bb88eadb519c7bd267bd56149"}, "sources": [{"url": "https://ftp.postgresql.org/pub/source/v12.22/postgresql-12.22.tar.bz2", "label": "Matching PostgreSQL source archive", "sha256": "8df3c0474782589d3c6f374b5133b1bd14d168086edbc13c6e72e67dd4527a3b"}, {"url": "/docs/12/auth-cert.html", "path": "auth-cert.html", "label": "PostgreSQL 12 English manual", "sha256": "de504e48f20680d3d4f058c93258cebd8ada3865f87fbc295e77871dc4928bbf"}, {"url": "/docs/12/auth-pg-hba-conf.html", "path": "auth-pg-hba-conf.html", "label": "PostgreSQL 12 English manual", "sha256": "07e8cddcb38076c86dab95b72c4380a7a325f22401b5b7f9af5dd4931876f2cb"}], "sections": [], "signature": "", "attributes": {"method": "cert", "inventory": "User-visible source authentication method", "configuration": "pg_hba.conf"}, "description": ["Authenticate using SSL client certificates. See Section 20.12 for details."], "manual_html": "
\n
\n
\n
\n

20.12.\u00a0Certificate Authentication

\n
\n
\n
\n

This authentication method uses SSL client certificates to perform authentication. It is therefore only available for SSL connections; see Section\u00a018.9.2 for SSL configuration instructions. When using this authentication method, the server will require that the client provide a valid, trusted certificate. No password prompt will be sent to the client. The cn (Common Name) attribute of the certificate will be compared to the requested database user name, and if they match the login will be allowed. User name mapping can be used to allow cn to be different from the database user name.

\n

The following configuration options are supported for SSL certificate authentication:

\n
\n
\n
map
\n
\n

Allows for mapping between system and database user names. See Section\u00a020.2 for details.

\n
\n
\n
\n

It is redundant to use the clientcert option with cert authentication because cert authentication is effectively trust authentication with clientcert=verify-full.

\n
", "manual_path": "/docs/12/auth-cert.html", "comparison_data": {"method": "cert", "documented_option_names": ["map"]}, "comparison_hash": "40542fff8f26666c5c9e9d161e6288daf51bf13f0e269760dbc632420d0e4b94"}, "13": {"facts": [{"label": "Method", "value": "cert"}, {"label": "Configuration", "value": "pg_hba.conf"}, {"label": "Inventory", "value": "User-visible source authentication method"}], "tables": [{"key": "method-options", "rows": [{"name": "map", "description": "Allows for mapping between system and database user names. See Section 20.2 for details."}], "title": "Documented method options and alternatives", "columns": [{"key": "name", "label": "Option or term"}, {"key": "description", "label": "Meaning"}]}], "aliases": [], "related": [], "release": {"ref": "https://ftp.postgresql.org/pub/source/v13.23/postgresql-13.23.tar.bz2", "label": "13.23", "major": "13", "channel": "historical", "revision": "6ec3c82726af92b7dec873fa1cdf881eca92a4219787dfad05acb6b10e041fd6", "source_sha256": "6ec3c82726af92b7dec873fa1cdf881eca92a4219787dfad05acb6b10e041fd6", "catalog_fingerprint": "c7015c845255c9d721c547c8ab9ef37825d332588c9691d982e6906b7d571002"}, "sources": [{"url": "https://ftp.postgresql.org/pub/source/v13.23/postgresql-13.23.tar.bz2", "label": "Matching PostgreSQL source archive", "sha256": "6ec3c82726af92b7dec873fa1cdf881eca92a4219787dfad05acb6b10e041fd6"}, {"url": "/docs/13/auth-cert.html", "path": "auth-cert.html", "label": "PostgreSQL 13 English manual", "sha256": "1ba13296373440e3d9db9c61cc659288cf2c580321071974b2c2e3e80ca724cd"}, {"url": "/docs/13/auth-pg-hba-conf.html", "path": "auth-pg-hba-conf.html", "label": "PostgreSQL 13 English manual", "sha256": "3cc6ce851945cba450e6b26ecf9cae1efd3c03fb7b55e17876f4d9ea418a7c2e"}], "sections": [], "signature": "", "attributes": {"method": "cert", "inventory": "User-visible source authentication method", "configuration": "pg_hba.conf"}, "description": ["Authenticate using SSL client certificates. See Section 20.12 for details."], "manual_html": "
\n
\n
\n
\n

20.12.\u00a0Certificate Authentication

\n
\n
\n
\n

This authentication method uses SSL client certificates to perform authentication. It is therefore only available for SSL connections; see Section\u00a018.9.2 for SSL configuration instructions. When using this authentication method, the server will require that the client provide a valid, trusted certificate. No password prompt will be sent to the client. The cn (Common Name) attribute of the certificate will be compared to the requested database user name, and if they match the login will be allowed. User name mapping can be used to allow cn to be different from the database user name.

\n

The following configuration options are supported for SSL certificate authentication:

\n
\n
\n
map
\n
\n

Allows for mapping between system and database user names. See Section\u00a020.2 for details.

\n
\n
\n
\n

It is redundant to use the clientcert option with cert authentication because cert authentication is effectively trust authentication with clientcert=verify-full.

\n
", "manual_path": "/docs/13/auth-cert.html", "comparison_data": {"method": "cert", "documented_option_names": ["map"]}, "comparison_hash": "40542fff8f26666c5c9e9d161e6288daf51bf13f0e269760dbc632420d0e4b94"}, "14": {"facts": [{"label": "Method", "value": "cert"}, {"label": "Configuration", "value": "pg_hba.conf"}, {"label": "Inventory", "value": "User-visible source authentication method"}], "tables": [{"key": "method-options", "rows": [{"name": "map", "description": "Allows for mapping between system and database user names. See Section 21.2 for details."}], "title": "Documented method options and alternatives", "columns": [{"key": "name", "label": "Option or term"}, {"key": "description", "label": "Meaning"}]}], "aliases": [], "related": [], "release": {"ref": "https://ftp.postgresql.org/pub/source/v14.24/postgresql-14.24.tar.bz2", "label": "14.24", "major": "14", "channel": "stable", "revision": "a7fa7ed3d558172355f51406097a7bd4f6b473be80f311ef7cda96bf383d8897", "source_sha256": "a7fa7ed3d558172355f51406097a7bd4f6b473be80f311ef7cda96bf383d8897", "catalog_fingerprint": "b272e6a82e4c46efda81c3a6a4cdf7de6a83dfff7f02f226a392fbe9acdd3adb"}, "sources": [{"url": "https://ftp.postgresql.org/pub/source/v14.24/postgresql-14.24.tar.bz2", "label": "Matching PostgreSQL source archive", "sha256": "a7fa7ed3d558172355f51406097a7bd4f6b473be80f311ef7cda96bf383d8897"}, {"url": "/docs/14/auth-cert.html", "path": "auth-cert.html", "label": "PostgreSQL 14 English manual", "sha256": "2c280a3eb9e29b1441fc990f839731db8e859ec96475f6ca41644959ec181c5f"}, {"url": "/docs/14/auth-pg-hba-conf.html", "path": "auth-pg-hba-conf.html", "label": "PostgreSQL 14 English manual", "sha256": "c9a75f04fd4a1069ea261ba061578a75c47a4b7e0bbf88761502fd4c19ccbc3f"}], "sections": [], "signature": "", "attributes": {"method": "cert", "inventory": "User-visible source authentication method", "configuration": "pg_hba.conf"}, "description": ["Authenticate using SSL client certificates. See Section 21.12 for details."], "manual_html": "
\n
\n
\n
\n

21.12.\u00a0Certificate Authentication

\n
\n
\n
\n

This authentication method uses SSL client certificates to perform authentication. It is therefore only available for SSL connections; see Section\u00a019.9.2 for SSL configuration instructions. When using this authentication method, the server will require that the client provide a valid, trusted certificate. No password prompt will be sent to the client. The cn (Common Name) attribute of the certificate will be compared to the requested database user name, and if they match the login will be allowed. User name mapping can be used to allow cn to be different from the database user name.

\n

The following configuration options are supported for SSL certificate authentication:

\n
\n
\n
map
\n
\n

Allows for mapping between system and database user names. See Section\u00a021.2 for details.

\n
\n
\n
\n

It is redundant to use the clientcert option with cert authentication because cert authentication is effectively trust authentication with clientcert=verify-full.

\n
", "manual_path": "/docs/14/auth-cert.html", "comparison_data": {"method": "cert", "documented_option_names": ["map"]}, "comparison_hash": "40542fff8f26666c5c9e9d161e6288daf51bf13f0e269760dbc632420d0e4b94"}, "15": {"facts": [{"label": "Method", "value": "cert"}, {"label": "Configuration", "value": "pg_hba.conf"}, {"label": "Inventory", "value": "User-visible source authentication method"}], "tables": [{"key": "method-options", "rows": [{"name": "map", "description": "Allows for mapping between system and database user names. See Section 21.2 for details."}], "title": "Documented method options and alternatives", "columns": [{"key": "name", "label": "Option or term"}, {"key": "description", "label": "Meaning"}]}], "aliases": [], "related": [], "release": {"ref": "https://ftp.postgresql.org/pub/source/v15.19/postgresql-15.19.tar.bz2", "label": "15.19", "major": "15", "channel": "stable", "revision": "e1a64a87a46b825b88c082e4518161a47aab53c45694964f8ba1df28f7859f89", "source_sha256": "e1a64a87a46b825b88c082e4518161a47aab53c45694964f8ba1df28f7859f89", "catalog_fingerprint": "fefe3c425147a86defada190c9b0663cfe02caa1724f5dede93e46457572252d"}, "sources": [{"url": "https://ftp.postgresql.org/pub/source/v15.19/postgresql-15.19.tar.bz2", "label": "Matching PostgreSQL source archive", "sha256": "e1a64a87a46b825b88c082e4518161a47aab53c45694964f8ba1df28f7859f89"}, {"url": "/docs/15/auth-cert.html", "path": "auth-cert.html", "label": "PostgreSQL 15 English manual", "sha256": "9007562b93363a7e9685000cd13cc0ffe4005bbe2498a4fc38d958b11b27bb87"}, {"url": "/docs/15/auth-pg-hba-conf.html", "path": "auth-pg-hba-conf.html", "label": "PostgreSQL 15 English manual", "sha256": "0470cd3eeb82cbc32d4b8b79e29f4427bdfd01f5bb15e6d9b7cee2f6dd2bba44"}], "sections": [], "signature": "", "attributes": {"method": "cert", "inventory": "User-visible source authentication method", "configuration": "pg_hba.conf"}, "description": ["Authenticate using SSL client certificates. See Section 21.12 for details."], "manual_html": "
\n
\n
\n
\n

21.12.\u00a0Certificate Authentication

\n
\n
\n
\n

This authentication method uses SSL client certificates to perform authentication. It is therefore only available for SSL connections; see Section\u00a019.9.2 for SSL configuration instructions. When using this authentication method, the server will require that the client provide a valid, trusted certificate. No password prompt will be sent to the client. The cn (Common Name) attribute of the certificate will be compared to the requested database user name, and if they match the login will be allowed. User name mapping can be used to allow cn to be different from the database user name.

\n

The following configuration options are supported for SSL certificate authentication:

\n
\n
\n
map
\n
\n

Allows for mapping between system and database user names. See Section\u00a021.2 for details.

\n
\n
\n
\n

It is redundant to use the clientcert option with cert authentication because cert authentication is effectively trust authentication with clientcert=verify-full.

\n
", "manual_path": "/docs/15/auth-cert.html", "comparison_data": {"method": "cert", "documented_option_names": ["map"]}, "comparison_hash": "40542fff8f26666c5c9e9d161e6288daf51bf13f0e269760dbc632420d0e4b94"}, "16": {"facts": [{"label": "Method", "value": "cert"}, {"label": "Configuration", "value": "pg_hba.conf"}, {"label": "Inventory", "value": "User-visible source authentication method"}], "tables": [{"key": "method-options", "rows": [{"name": "map", "description": "Allows for mapping between system and database user names. See Section 21.2 for details."}], "title": "Documented method options and alternatives", "columns": [{"key": "name", "label": "Option or term"}, {"key": "description", "label": "Meaning"}]}], "aliases": [], "related": [], "release": {"ref": "https://ftp.postgresql.org/pub/source/v16.15/postgresql-16.15.tar.bz2", "label": "16.15", "major": "16", "channel": "stable", "revision": "c1575341fa7bd40f5274ea465b34390f4dc64cdd0770af327005caaeb9f6b7ed", "source_sha256": "c1575341fa7bd40f5274ea465b34390f4dc64cdd0770af327005caaeb9f6b7ed", "catalog_fingerprint": "fa133458dc8f52e15083b4f59b7a582e2e378b608d3ac5c53054df458a374e23"}, "sources": [{"url": "https://ftp.postgresql.org/pub/source/v16.15/postgresql-16.15.tar.bz2", "label": "Matching PostgreSQL source archive", "sha256": "c1575341fa7bd40f5274ea465b34390f4dc64cdd0770af327005caaeb9f6b7ed"}, {"url": "/docs/16/auth-cert.html", "path": "auth-cert.html", "label": "PostgreSQL 16 English manual", "sha256": "21c33fb03062a5a972c12584652276c4ed8a7f39cab1918355e4dbe213371822"}, {"url": "/docs/16/auth-pg-hba-conf.html", "path": "auth-pg-hba-conf.html", "label": "PostgreSQL 16 English manual", "sha256": "ccc5146375a184646d5992edbc693e12c0de4431a35141d6b56c8dd6b3c52132"}], "sections": [], "signature": "", "attributes": {"method": "cert", "inventory": "User-visible source authentication method", "configuration": "pg_hba.conf"}, "description": ["Authenticate using SSL client certificates. See Section 21.12 for details."], "manual_html": "
\n
\n
\n
\n

21.12.\u00a0Certificate Authentication

\n
\n
\n
\n

This authentication method uses SSL client certificates to perform authentication. It is therefore only available for SSL connections; see Section\u00a019.9.2 for SSL configuration instructions. When using this authentication method, the server will require that the client provide a valid, trusted certificate. No password prompt will be sent to the client. The cn (Common Name) attribute of the certificate will be compared to the requested database user name, and if they match the login will be allowed. User name mapping can be used to allow cn to be different from the database user name.

\n

The following configuration options are supported for SSL certificate authentication:

\n
\n
\n
map
\n
\n

Allows for mapping between system and database user names. See Section\u00a021.2 for details.

\n
\n
\n
\n

It is redundant to use the clientcert option with cert authentication because cert authentication is effectively trust authentication with clientcert=verify-full.

\n
", "manual_path": "/docs/16/auth-cert.html", "comparison_data": {"method": "cert", "documented_option_names": ["map"]}, "comparison_hash": "40542fff8f26666c5c9e9d161e6288daf51bf13f0e269760dbc632420d0e4b94"}, "17": {"facts": [{"label": "Method", "value": "cert"}, {"label": "Configuration", "value": "pg_hba.conf"}, {"label": "Inventory", "value": "User-visible source authentication method"}], "tables": [{"key": "method-options", "rows": [{"name": "map", "description": "Allows for mapping between system and database user names. See Section 20.2 for details."}], "title": "Documented method options and alternatives", "columns": [{"key": "name", "label": "Option or term"}, {"key": "description", "label": "Meaning"}]}], "aliases": [], "related": [], "release": {"ref": "https://ftp.postgresql.org/pub/source/v17.11/postgresql-17.11.tar.bz2", "label": "17.11", "major": "17", "channel": "stable", "revision": "dd27f2b3c59e73ed14aa3324901242bf69a032a6347805f274e6260322d42979", "source_sha256": "dd27f2b3c59e73ed14aa3324901242bf69a032a6347805f274e6260322d42979", "catalog_fingerprint": "4bbe3ac77becd618478f66aec420a533e9017be356c5c1d51a4b17f0fd497c07"}, "sources": [{"url": "https://ftp.postgresql.org/pub/source/v17.11/postgresql-17.11.tar.bz2", "label": "Matching PostgreSQL source archive", "sha256": "dd27f2b3c59e73ed14aa3324901242bf69a032a6347805f274e6260322d42979"}, {"url": "/docs/17/auth-cert.html", "path": "auth-cert.html", "label": "PostgreSQL 17 English manual", "sha256": "73c30d3a7d79f7d3df73f84f0ab5ccca9a34f2d9dd5923688af41567d01a2c28"}, {"url": "/docs/17/auth-pg-hba-conf.html", "path": "auth-pg-hba-conf.html", "label": "PostgreSQL 17 English manual", "sha256": "00c7a7c25d46aa1b2f24cd744cd4990ca4218cfafed2a4cab8c1dc1092090bba"}], "sections": [], "signature": "", "attributes": {"method": "cert", "inventory": "User-visible source authentication method", "configuration": "pg_hba.conf"}, "description": ["Authenticate using SSL client certificates. See Section 20.12 for details."], "manual_html": "
\n
\n
\n
\n

20.12.\u00a0Certificate Authentication

\n
\n
\n
\n

This authentication method uses SSL client certificates to perform authentication. It is therefore only available for SSL connections; see Section\u00a018.9.2 for SSL configuration instructions. When using this authentication method, the server will require that the client provide a valid, trusted certificate. No password prompt will be sent to the client. The cn (Common Name) attribute of the certificate will be compared to the requested database user name, and if they match the login will be allowed. User name mapping can be used to allow cn to be different from the database user name.

\n

The following configuration options are supported for SSL certificate authentication:

\n
\n
\n
map
\n
\n

Allows for mapping between system and database user names. See Section\u00a020.2 for details.

\n
\n
\n
\n

It is redundant to use the clientcert option with cert authentication because cert authentication is effectively trust authentication with clientcert=verify-full.

\n
", "manual_path": "/docs/17/auth-cert.html", "comparison_data": {"method": "cert", "documented_option_names": ["map"]}, "comparison_hash": "40542fff8f26666c5c9e9d161e6288daf51bf13f0e269760dbc632420d0e4b94"}, "18": {"facts": [{"label": "Method", "value": "cert"}, {"label": "Configuration", "value": "pg_hba.conf"}, {"label": "Inventory", "value": "User-visible source authentication method"}], "tables": [{"key": "method-options", "rows": [{"name": "map", "description": "Allows for mapping between system and database user names. See Section 20.2 for details."}], "title": "Documented method options and alternatives", "columns": [{"key": "name", "label": "Option or term"}, {"key": "description", "label": "Meaning"}]}], "aliases": [], "related": [], "release": {"ref": "https://ftp.postgresql.org/pub/source/v18.6/postgresql-18.6.tar.bz2", "label": "18.6", "major": "18", "channel": "stable", "revision": "555610c24d53e4316da5b7d3fc25c279d96856d5e0e23ee308c328c5fa881d9f", "source_sha256": "555610c24d53e4316da5b7d3fc25c279d96856d5e0e23ee308c328c5fa881d9f", "catalog_fingerprint": "65c93d6048ef30e61023a84f9680fa6a92b1c383b7eb226741170077eb078502"}, "sources": [{"url": "https://ftp.postgresql.org/pub/source/v18.6/postgresql-18.6.tar.bz2", "label": "Matching PostgreSQL source archive", "sha256": "555610c24d53e4316da5b7d3fc25c279d96856d5e0e23ee308c328c5fa881d9f"}, {"url": "/docs/18/auth-cert.html", "path": "auth-cert.html", "label": "PostgreSQL 18 English manual", "sha256": "b43c008f505f9b377b2712eef6c9f98a10a3074642ca173f46e44316305c02ad"}, {"url": "/docs/18/auth-pg-hba-conf.html", "path": "auth-pg-hba-conf.html", "label": "PostgreSQL 18 English manual", "sha256": "6340d4abea2e0a3482afc31bcd1599a0fa10dc28a6f1e05d79ba831e2dd0b4c9"}], "sections": [], "signature": "", "attributes": {"method": "cert", "inventory": "User-visible source authentication method", "configuration": "pg_hba.conf"}, "description": ["Authenticate using SSL client certificates. See Section 20.12 for details."], "manual_html": "
\n
\n
\n
\n

20.12.\u00a0Certificate Authentication

\n
\n
\n
\n

This authentication method uses SSL client certificates to perform authentication. It is therefore only available for SSL connections; see Section\u00a018.9.2 for SSL configuration instructions. When using this authentication method, the server will require that the client provide a valid, trusted certificate. No password prompt will be sent to the client. The cn (Common Name) attribute of the certificate will be compared to the requested database user name, and if they match the login will be allowed. User name mapping can be used to allow cn to be different from the database user name.

\n

The following configuration options are supported for SSL certificate authentication:

\n
\n
\n
map
\n
\n

Allows for mapping between system and database user names. See Section\u00a020.2 for details.

\n
\n
\n
\n

It is redundant to use the clientcert option with cert authentication because cert authentication is effectively trust authentication with clientcert=verify-full.

\n
", "manual_path": "/docs/18/auth-cert.html", "comparison_data": {"method": "cert", "documented_option_names": ["map"]}, "comparison_hash": "40542fff8f26666c5c9e9d161e6288daf51bf13f0e269760dbc632420d0e4b94"}, "19": {"facts": [{"label": "Method", "value": "cert"}, {"label": "Configuration", "value": "pg_hba.conf"}, {"label": "Inventory", "value": "User-visible source authentication method"}], "tables": [{"key": "method-options", "rows": [{"name": "map", "description": "Allows for mapping between system and database user names. See Section 20.2 for details."}], "title": "Documented method options and alternatives", "columns": [{"key": "name", "label": "Option or term"}, {"key": "description", "label": "Meaning"}]}], "aliases": [], "related": [], "release": {"ref": "https://ftp.postgresql.org/pub/source/v19beta4/postgresql-19beta4.tar.bz2", "label": "19beta4", "major": "19", "channel": "preview", "revision": "83157ee9c599d03b2f7a3d73ef3a56ec24e0e79cc2b3501a64d1364f56398c86", "source_sha256": "83157ee9c599d03b2f7a3d73ef3a56ec24e0e79cc2b3501a64d1364f56398c86", "catalog_fingerprint": "62fbf1a3689dbe8bf7e6b3372cfe6fbf867581427b3858a94c8419b77a4d2d1d"}, "sources": [{"url": "https://ftp.postgresql.org/pub/source/v19beta4/postgresql-19beta4.tar.bz2", "label": "Matching PostgreSQL source archive", "sha256": "83157ee9c599d03b2f7a3d73ef3a56ec24e0e79cc2b3501a64d1364f56398c86"}, {"url": "/docs/19/auth-cert.html", "path": "auth-cert.html", "label": "PostgreSQL 19 English manual", "sha256": "2fde331839fb0e4dbaf34ff3caa5c27ec7607d70395a8e9f0ec99308098f8164"}, {"url": "/docs/19/auth-pg-hba-conf.html", "path": "auth-pg-hba-conf.html", "label": "PostgreSQL 19 English manual", "sha256": "d05e9155d5388148c2c680ff208b62c6b3b0b1c30f302ada5ab4befec36c19b7"}], "sections": [], "signature": "", "attributes": {"method": "cert", "inventory": "User-visible source authentication method", "configuration": "pg_hba.conf"}, "description": ["Authenticate using SSL client certificates. See Section 20.11 for details."], "manual_html": "
\n
\n
\n
\n

20.11.\u00a0Certificate Authentication

\n
\n
\n
\n

This authentication method uses SSL client certificates to perform authentication. It is therefore only available for SSL connections; see Section\u00a018.9.2 for SSL configuration instructions. When using this authentication method, the server will require that the client provide a valid, trusted certificate. No password prompt will be sent to the client. The cn (Common Name) attribute of the certificate will be compared to the requested database user name, and if they match the login will be allowed. User name mapping can be used to allow cn to be different from the database user name.

\n

The following configuration options are supported for SSL certificate authentication:

\n
\n
\n
map
\n
\n

Allows for mapping between system and database user names. See Section\u00a020.2 for details.

\n
\n
\n
\n

It is redundant to use the clientcert option with cert authentication because cert authentication is effectively trust authentication with clientcert=verify-full.

\n
", "manual_path": "/docs/19/auth-cert.html", "comparison_data": {"method": "cert", "documented_option_names": ["map"]}, "comparison_hash": "40542fff8f26666c5c9e9d161e6288daf51bf13f0e269760dbc632420d0e4b94"}, "20": {"facts": [{"label": "Method", "value": "cert"}, {"label": "Configuration", "value": "pg_hba.conf"}, {"label": "Inventory", "value": "User-visible source authentication method"}], "tables": [{"key": "method-options", "rows": [{"name": "map", "description": "Allows for mapping between system and database user names. See Section 20.2 for details."}], "title": "Documented method options and alternatives", "columns": [{"key": "name", "label": "Option or term"}, {"key": "description", "label": "Meaning"}]}], "aliases": [], "related": [], "release": {"ref": "https://ftp.postgresql.org/pub/snapshot/dev/postgresql-snapshot.tar.bz2", "label": "20devel", "major": "20", "channel": "devel", "revision": "4d3346909b201ac1648232cf290462a7070c119326f56196f1f0253ed80fae41", "source_sha256": "4d3346909b201ac1648232cf290462a7070c119326f56196f1f0253ed80fae41", "catalog_fingerprint": "398fbb9f262264053c02fbf79f88be0a6770c1473faa6ecd5931d6ec41b8258b", "source_snapshot_utc": "26-Sep-2026 20:22"}, "sources": [{"url": "https://ftp.postgresql.org/pub/snapshot/dev/postgresql-snapshot.tar.bz2", "label": "Matching PostgreSQL source archive", "sha256": "4d3346909b201ac1648232cf290462a7070c119326f56196f1f0253ed80fae41"}, {"url": "/docs/devel/auth-cert.html", "path": "auth-cert.html", "label": "PostgreSQL 20 English manual", "sha256": "895f8f07dbc36f4fdbd54bd30e1e9dd6d8d26d4759222856e18d34a23c8968ec"}, {"url": "/docs/devel/auth-pg-hba-conf.html", "path": "auth-pg-hba-conf.html", "label": "PostgreSQL 20 English manual", "sha256": "cf2069461da3eec62f6fb4e3df8e46fd69ff4b3a2ad059eec355cee256d7996e"}], "sections": [], "signature": "", "attributes": {"method": "cert", "inventory": "User-visible source authentication method", "configuration": "pg_hba.conf"}, "description": ["Authenticate using SSL client certificates. See Section 20.11 for details."], "manual_html": "
\n
\n
\n
\n

20.11.\u00a0Certificate Authentication

\n
\n
\n
\n

This authentication method uses SSL client certificates to perform authentication. It is therefore only available for SSL connections; see Section\u00a018.9.2 for SSL configuration instructions. When using this authentication method, the server will require that the client provide a valid, trusted certificate. No password prompt will be sent to the client. The cn (Common Name) attribute of the certificate will be compared to the requested database user name, and if they match the login will be allowed. User name mapping can be used to allow cn to be different from the database user name.

\n

The following configuration options are supported for SSL certificate authentication:

\n
\n
\n
map
\n
\n

Allows for mapping between system and database user names. See Section\u00a020.2 for details.

\n
\n
\n
\n

It is redundant to use the clientcert option with cert authentication because cert authentication is effectively trust authentication with clientcert=verify-full.

\n
", "manual_path": "/docs/devel/auth-cert.html", "comparison_data": {"method": "cert", "documented_option_names": ["map"]}, "comparison_hash": "40542fff8f26666c5c9e9d161e6288daf51bf13f0e269760dbc632420d0e4b94"}}}, "snapshot": {"facts": [{"label": "Method", "value": "cert"}, {"label": "Configuration", "value": "pg_hba.conf"}, {"label": "Inventory", "value": "User-visible source authentication method"}], "tables": [{"key": "method-options", "rows": [{"name": "map", "description": "Allows for mapping between system and database user names. See Section 20.2 for details."}], "title": "Documented method options and alternatives", "columns": [{"key": "name", "label": "Option or term"}, {"key": "description", "label": "Meaning"}]}], "aliases": [], "related": [], "release": {"ref": "https://ftp.postgresql.org/pub/source/v18.6/postgresql-18.6.tar.bz2", "label": "18.6", "major": "18", "channel": "stable", "revision": "555610c24d53e4316da5b7d3fc25c279d96856d5e0e23ee308c328c5fa881d9f", "source_sha256": "555610c24d53e4316da5b7d3fc25c279d96856d5e0e23ee308c328c5fa881d9f", "catalog_fingerprint": "65c93d6048ef30e61023a84f9680fa6a92b1c383b7eb226741170077eb078502"}, "sources": [{"url": "https://ftp.postgresql.org/pub/source/v18.6/postgresql-18.6.tar.bz2", "label": "Matching PostgreSQL source archive", "sha256": "555610c24d53e4316da5b7d3fc25c279d96856d5e0e23ee308c328c5fa881d9f"}, {"url": "/docs/18/auth-cert.html", "path": "auth-cert.html", "label": "PostgreSQL 18 English manual", "sha256": "b43c008f505f9b377b2712eef6c9f98a10a3074642ca173f46e44316305c02ad"}, {"url": "/docs/18/auth-pg-hba-conf.html", "path": "auth-pg-hba-conf.html", "label": "PostgreSQL 18 English manual", "sha256": "6340d4abea2e0a3482afc31bcd1599a0fa10dc28a6f1e05d79ba831e2dd0b4c9"}], "sections": [], "signature": "", "attributes": {"method": "cert", "inventory": "User-visible source authentication method", "configuration": "pg_hba.conf"}, "description": ["Authenticate using SSL client certificates. See Section 20.12 for details."], "manual_html": "
\n
\n
\n
\n

20.12.\u00a0Certificate Authentication

\n
\n
\n
\n

This authentication method uses SSL client certificates to perform authentication. It is therefore only available for SSL connections; see Section\u00a018.9.2 for SSL configuration instructions. When using this authentication method, the server will require that the client provide a valid, trusted certificate. No password prompt will be sent to the client. The cn (Common Name) attribute of the certificate will be compared to the requested database user name, and if they match the login will be allowed. User name mapping can be used to allow cn to be different from the database user name.

\n

The following configuration options are supported for SSL certificate authentication:

\n
\n
\n
map
\n
\n

Allows for mapping between system and database user names. See Section\u00a020.2 for details.

\n
\n
\n
\n

It is redundant to use the clientcert option with cert authentication because cert authentication is effectively trust authentication with clientcert=verify-full.

\n
", "manual_path": "/docs/18/auth-cert.html", "comparison_data": {"method": "cert", "documented_option_names": ["map"]}, "comparison_hash": "40542fff8f26666c5c9e9d161e6288daf51bf13f0e269760dbc632420d0e4b94"}, "comparison": {"left": "17", "right": "18", "status": "unchanged", "diff": ""}}