{"Entry":{"collection":"conn","key":"sslcertmode","name":"sslcertmode","aliases":["PGSSLCERTMODE","sslcertmode"],"metadata":{"aliases":["PGSSLCERTMODE","sslcertmode"],"category":"TLS","content_hash":"5e9918f7cf901f4522deaecdb8b315a03007df3152825df872acc543ff99ea29","derived_content_hash":"5732ac3c6da6742e91c400c25c82ee98375b7261ec09d8eae1ba0b85d400651b","documentation_refresh":{"batch":"20261113","original_source_rev":"","versions":{"16":"16.16","17":"17.12","18":"18.7","19":"19rc2"}},"imported_at":"2026-09-30T00:40:35.104012+08:00","name":"sslcertmode","name_zh":"","slug":"sslcertmode","summary":"This option determines whether a client certificate may be sent to the server, and whether the server is required to request one. There are three modes:"}},"Definition":{"Collection":"conn","Key":"sslcertmode","SourceDatabase":"center","Version":"18","SourceTable":"connection_parameter","SourceKey":"sslcertmode","SourceRevision":"ee8d1a3612338fd9adf250730cb640fcc5233b5491337cc00a316a44e3a0b9f8","Facts":{"comparison_data":{"compiled_default_expression":"NULL","default_evidence":["A client certificate is never sent, even if one is available (default location or provided via sslcert )."],"definition":"This option determines whether a client certificate may be sent to the server, and whether the server is required to request one. There are three modes: disable A client certificate is never sent, even if one is available (default location or provided via sslcert ). allow (default) A certificate may be sent, if the server requests one and the client has one to send. require The server must request a certificate. The connection will fail if the client does not send a certificate and the server successfully authenticates the client anyway. Note sslcertmode=require doesn't add any additional security, since there is no guarantee that the server is validating the certificate correctly; PostgreSQL servers generally request TLS certificates from clients whether they validate them or not. The option may be useful when troubleshooting more complicated TLS setups.","documented":true,"environment":"PGSSLCERTMODE","keyword":"sslcertmode"},"comparison_hash":"f50d0868140d654ab2a45fb10a39e86a71d91b6d300ea34d3c28088537c8fdc5","default_evidence":["A client certificate is never sent, even if one is available (default location or provided via sslcert )."],"description":["This option determines whether a client certificate may be sent to the server, and whether the server is required to request one. There are three modes:"],"description_zh":"此选项决定是否可以向服务器发送客户端证书，以及服务器是否必须请求客户端证书。共有三种模式： disable 即使客户端有可用证书（默认位置或通过 sslcert 提供），也绝不发送客户端证书。 allow （默认） 如果服务器请求证书且客户端有证书可发，则可以发送证书。 require 服务器 必须 请求证书。如果客户端没有发送证书而服务器仍成功认证了客户端，则连接将失败。 注意 sslcertmode=require 不会增加额外的安全性，因为无法保证服务器一定正确验证了证书； PostgreSQL 服务器通常无论是否验证，都会向客户端请求 TLS 证书。该选项在排查更复杂的 TLS 配置时可能有用。","description_zh_html":"\u003cp\u003e连接参数 sslcertmode。\u003c/p\u003e\u003ch3\u003e同版本中文手册定义\u003c/h3\u003e\u003cdd\u003e\u003cp\u003e\n        此选项决定是否可以向服务器发送客户端证书，以及服务器是否必须请求客户端证书。共有三种模式：\n\n        \u003c/p\u003e\u003cdiv class=\"variablelist\"\u003e\u003cdl class=\"variablelist\"\u003e\u003cdt\u003e\u003cspan class=\"term\"\u003e\u003ccode class=\"literal\"\u003edisable\u003c/code\u003e\u003c/span\u003e\u003c/dt\u003e\u003cdd\u003e\u003cp\u003e\n            即使客户端有可用证书（默认位置或通过 \u003ca class=\"xref\" href=\"/zh/docs/18/libpq-connect.html#LIBPQ-CONNECT-SSLCERT\"\u003esslcert\u003c/a\u003e 提供），也绝不发送客户端证书。\n           \u003c/p\u003e\u003c/dd\u003e\u003cdt\u003e\u003cspan class=\"term\"\u003e\u003ccode class=\"literal\"\u003eallow\u003c/code\u003e（默认）\u003c/span\u003e\u003c/dt\u003e\u003cdd\u003e\u003cp\u003e\n            如果服务器请求证书且客户端有证书可发，则可以发送证书。\n           \u003c/p\u003e\u003c/dd\u003e\u003cdt\u003e\u003cspan class=\"term\"\u003e\u003ccode class=\"literal\"\u003erequire\u003c/code\u003e\u003c/span\u003e\u003c/dt\u003e\u003cdd\u003e\u003cp\u003e\n            服务器\u003cspan class=\"emphasis\"\u003e\u003cem\u003e必须\u003c/em\u003e\u003c/span\u003e请求证书。如果客户端没有发送证书而服务器仍成功认证了客户端，则连接将失败。\n           \u003c/p\u003e\u003c/dd\u003e\u003c/dl\u003e\u003c/div\u003e\u003cp\u003e\n\u003c/p\u003e\u003cdiv class=\"note\"\u003e\u003ch3 class=\"title\"\u003e注意\u003c/h3\u003e\u003cp\u003e\n\u003ccode class=\"literal\"\u003esslcertmode=require\u003c/code\u003e 不会增加额外的安全性，因为无法保证服务器一定正确验证了证书；\u003cspan class=\"productname\"\u003ePostgreSQL\u003c/span\u003e 服务器通常无论是否验证，都会向客户端请求 TLS 证书。该选项在排查更复杂的 TLS 配置时可能有用。\n        \u003c/p\u003e\u003c/div\u003e\u003c/dd\u003e\u003cp\u003e\u003ca href=\"/zh/docs/18/libpq-connect.html#LIBPQ-CONNECT-SSLCERTMODE\"\u003e查看完整中文手册与上下文\u003c/a\u003e。\u003c/p\u003e","documented":true,"environment":[{"description":"PGSSLCERTMODE behaves the same as the sslcertmode connection parameter.","name":"PGSSLCERTMODE","source_url":"/docs/18/libpq-envars.html"}],"facts":[{"label":"Client library","value":"libpq 18.6"},{"label":"Manual definition","value":"Documented"},{"label":"Source environment fallback","value":"PGSSLCERTMODE"},{"label":"Compiled fallback expression","value":"NULL"}],"facts_zh":[{"label":"客户端库","value":"libpq 18.6"},{"label":"手册定义","value":"手册已记载"},{"label":"源码中的环境变量回退","value":"PGSSLCERTMODE"},{"label":"编译时回退表达式","value":"NULL"}],"keyword":"sslcertmode","manual_html":"\u003cdiv\u003e\u003cdl class=\"variablelist\"\u003e\u003cdt id=\"LIBPQ-CONNECT-SSLCERTMODE\"\u003e\u003cspan class=\"term\"\u003e\u003ccode class=\"literal\"\u003esslcertmode\u003c/code\u003e\u003c/span\u003e \u003c/dt\u003e\u003cdd\u003e\n\u003cp\u003eThis option determines whether a client certificate may be sent to the server, and whether the server is required to request one. There are three modes:\u003c/p\u003e\n\u003cdiv class=\"variablelist\"\u003e\n\u003cdl class=\"variablelist\"\u003e\n\u003cdt\u003e\u003cspan class=\"term\"\u003e\u003ccode class=\"literal\"\u003edisable\u003c/code\u003e\u003c/span\u003e\u003c/dt\u003e\n\u003cdd\u003e\n\u003cp\u003eA client certificate is never sent, even if one is available (default location or provided via \u003ca class=\"xref\" href=\"/docs/18/libpq-connect.html#LIBPQ-CONNECT-SSLCERT\"\u003esslcert\u003c/a\u003e).\u003c/p\u003e\n\u003c/dd\u003e\n\u003cdt\u003e\u003cspan class=\"term\"\u003e\u003ccode class=\"literal\"\u003eallow\u003c/code\u003e (default)\u003c/span\u003e\u003c/dt\u003e\n\u003cdd\u003e\n\u003cp\u003eA certificate may be sent, if the server requests one and the client has one to send.\u003c/p\u003e\n\u003c/dd\u003e\n\u003cdt\u003e\u003cspan class=\"term\"\u003e\u003ccode class=\"literal\"\u003erequire\u003c/code\u003e\u003c/span\u003e\u003c/dt\u003e\n\u003cdd\u003e\n\u003cp\u003eThe server \u003cspan class=\"emphasis\"\u003e\u003cem\u003emust\u003c/em\u003e\u003c/span\u003e request a certificate. The connection will fail if the client does not send a certificate and the server successfully authenticates the client anyway.\u003c/p\u003e\n\u003c/dd\u003e\n\u003c/dl\u003e\n\u003c/div\u003e\n\u003cdiv class=\"note\"\u003e\n\u003ch3 class=\"title\"\u003eNote\u003c/h3\u003e\n\u003cp\u003e\u003ccode class=\"literal\"\u003esslcertmode=require\u003c/code\u003e doesn't add any additional security, since there is no guarantee that the server is validating the certificate correctly; PostgreSQL servers generally request TLS certificates from clients whether they validate them or not. The option may be useful when troubleshooting more complicated TLS setups.\u003c/p\u003e\n\u003c/div\u003e\n\u003c/dd\u003e\u003c/dl\u003e\u003c/div\u003e","manual_path":"libpq-connect.html#LIBPQ-CONNECT-SSLCERTMODE","precedence_evidence":["The following environment variables can be used to select default connection parameter values, which will be used by PQconnectdb , PQsetdbLogin and PQsetdb if no value is directly specified by the calling code. These are useful to avoid hard-coding database connection information into simple client applications, for example.","Service names can be defined in either a per-user service file or a system-wide file. If the same service name exists in both the user and the system file, the user file takes precedence. By default, the per-user service file is named ~/.pg_service.conf . On Microsoft Windows, it is named %APPDATA%\\postgresql\\.pg_service.conf (where %APPDATA% refers to the Application Data subdirectory in the user's profile). A different file name can be specified by setting the environment variable PGSERVICEFILE . The system-wide file is named pg_service.conf . By default it is sought in the etc directory of the PostgreSQL installation (use pg_config --sysconfdir to identify this directory precisely). Another directory, but not a different file name, can be specified by setting the environment variable PGSYSCONFDIR .","Connection parameters obtained from a service file are combined with parameters obtained from other sources. A service file setting overrides the corresponding environment variable, and in turn can be overridden by a value given directly in the connection string. For example, using the above service file, a connection string service=mydb port=5434 will use host somehost , port 5434 , user admin , and other parameters as set by environment variables or built-in defaults."],"related":[{"label":"Connection service file","url":"/docs/18/libpq-pgservice.html"},{"label":"Password file","url":"/docs/18/libpq-pgpass.html"},{"label":"All libpq environment variables","url":"/docs/18/libpq-envars.html"}],"release":{"channel":"stable","evidence_kind":"English manual and source declarations","label":"18.6","major":"18","manifest":{"index":"index.html","major":"18","pages":1148,"pdf":{"A4":{"built_at":"2026-09-26","bytes":15865106,"pages":3154,"sha256":"19512c405da53f9f7fcf0abba359223aa65f021be025bf3411381918f92e3190","url":"/files/documentation/pdf/18/postgresql-18-A4.pdf"},"US":{"built_at":"2026-09-26","bytes":15748059,"pages":3328,"sha256":"facbe6c229e598b872d3d98bef53308f46e06746006fa4590de9a7de9dd46319","url":"/files/documentation/pdf/18/postgresql-18-US.pdf"}},"release":"18.6","source_mode":"en SGML built with pinned official archive","source_sha256":"555610c24d53e4316da5b7d3fc25c279d96856d5e0e23ee308c328c5fa881d9f","source_url":"https://ftp.postgresql.org/pub/source/v18.6/postgresql-18.6.tar.bz2","svg_assets":3,"tree":"18"},"ref":"https://ftp.postgresql.org/pub/source/v18.6/postgresql-18.6.tar.bz2","revision":"ee8d1a3612338fd9adf250730cb640fcc5233b5491337cc00a316a44e3a0b9f8","source_sha256":"555610c24d53e4316da5b7d3fc25c279d96856d5e0e23ee308c328c5fa881d9f"},"sections":[{"paragraphs":["The following environment variables can be used to select default connection parameter values, which will be used by PQconnectdb , PQsetdbLogin and PQsetdb if no value is directly specified by the calling code. These are useful to avoid hard-coding database connection information into simple client applications, for example.","Service names can be defined in either a per-user service file or a system-wide file. If the same service name exists in both the user and the system file, the user file takes precedence. By default, the per-user service file is named ~/.pg_service.conf . On Microsoft Windows, it is named %APPDATA%\\postgresql\\.pg_service.conf (where %APPDATA% refers to the Application Data subdirectory in the user's profile). A different file name can be specified by setting the environment variable PGSERVICEFILE . The system-wide file is named pg_service.conf . By default it is sought in the etc directory of the PostgreSQL installation (use pg_config --sysconfdir to identify this directory precisely). Another directory, but not a different file name, can be specified by setting the environment variable PGSYSCONFDIR .","Connection parameters obtained from a service file are combined with parameters obtained from other sources. A service file setting overrides the corresponding environment variable, and in turn can be overridden by a value given directly in the connection string. For example, using the above service file, a connection string service=mydb port=5434 will use host somehost , port 5434 , user admin , and other parameters as set by environment variables or built-in defaults."],"title":"Default resolution and service-file precedence"},{"paragraphs":["PGSSLCERTMODE behaves the same as the sslcertmode connection parameter."],"title":"Environment variable evidence"}],"sections_zh":[{"paragraphs":["以下环境变量可用于选择连接参数的默认值，供 PQconnectdb 、 PQsetdbLogin 和 PQsetdb 在调用代码未直接指定参数值时使用。例如，这样可以避免在简单的客户端应用程序中硬编码数据库连接信息。","服务名称可以在每个用户的服务文件或系统范围的文件中定义。如果同一个服务名称存在于用户文件和系统文件中，则用户文件优先。默认情况下，每个用户的服务文件名为 ~/.pg_service.conf 。在Microsoft Windows上，它的名称为 %APPDATA%\\postgresql\\.pg_service.conf （其中 %APPDATA% 指用户配置文件夹中的应用数据子目录）。可以通过设置环境变量 PGSERVICEFILE 来指定不同的文件名。系统范围的文件名为 pg_service.conf 。默认情况下，在 PostgreSQL 安装的 etc 目录中寻找（使用 pg_config --sysconfdir 来准确识别此目录）。可以通过设置环境变量 PGSYSCONFDIR 来指定另一个目录，但不能指定不同的文件名。","从服务文件中获取的连接参数会与其他来源的参数合并。服务文件中的设置会覆盖相应的环境变量，而连接字符串中直接给出的值又会覆盖服务文件中的设置。例如，使用上述服务文件时，连接字符串 service=mydb port=5434 将使用主机 somehost 、端口 5434 、用户 admin ，以及由环境变量或内置默认值设置的其他参数。"],"title":"默认值解析与服务文件优先级"},{"paragraphs":["PGSSLCERTMODE 的行为与 sslcertmode 连接参数相同。"],"title":"环境变量证据"}],"signature":"sslcertmode","source_option":{"compiled_default_expression":"NULL","declaration":"\"sslcertmode\", \"PGSSLCERTMODE\", NULL, NULL, \"SSL-Client-Cert-Mode\", \"\", 8, offsetof(struct pg_conn, sslcertmode)","environment":"PGSSLCERTMODE","keyword":"sslcertmode","source_notes":[]},"sources":[{"anchor":"LIBPQ-CONNECT-SSLCERTMODE","file":"libpq-connect.html","label":"18.6 English manual · libpq-connect.html","sha256":"c26a7fc3dcda6066cfe540641ae2690faf3d3c03277f30b4dfc2328ab45c212f","url":"/docs/18/libpq-connect.html#LIBPQ-CONNECT-SSLCERTMODE"},{"archive_sha256":"555610c24d53e4316da5b7d3fc25c279d96856d5e0e23ee308c328c5fa881d9f","file":"src/interfaces/libpq/fe-connect.c","label":"18.6 libpq connection option declarations","sha256":"44a6e386cbfd67ebe768d6ef5493098119c2e6b4796239d53e5ed7b122b206a5","url":"https://ftp.postgresql.org/pub/source/v18.6/postgresql-18.6.tar.bz2"},{"anchor":"","file":"libpq-envars.html","label":"18.6 English manual · libpq-envars.html","sha256":"d64db73f3d48127bb984a5f775e77b7bcca2ba4bd218333cf24a45fcdd7c4363","url":"/docs/18/libpq-envars.html"},{"anchor":"","file":"libpq-pgservice.html","label":"18.6 English manual · libpq-pgservice.html","sha256":"6035a3f0ee1d0fd80db5bf58834390b884eecd23206659bdf6f07560deea5aa7","url":"/docs/18/libpq-pgservice.html"}],"tables":[{"columns":[{"key":"name","label":"Variable"},{"key":"description","label":"Documented behavior"}],"key":"environment","rows":[{"description":"PGSSLCERTMODE behaves the same as the sslcertmode connection parameter.","name":{"text":"PGSSLCERTMODE","url":"/docs/18/libpq-envars.html"}}],"title":"Environment fallback"}],"tables_zh":[{"columns":[{"key":"name","label":"变量"},{"key":"description","label":"手册记载的行为"}],"key":"environment","rows":[{"description":"PGSSLCERTMODE 的行为与 sslcertmode 连接参数相同。","name":{"text":"PGSSLCERTMODE","url":"/docs/18/libpq-envars.html"}}],"title":"环境变量回退"}],"zh_from":{"authored_translation":"source-derived-identity","body_sha256":"e0ffd60900700b7839c249522008ca82b7636428938d7eced52736c022b7ddfc","kind":"same-version-chinese-manual-with-source-derived-identity","manual":{"anchor":"LIBPQ-CONNECT-SSLCERTMODE","build_id":107,"extraction":"exact-definition","fragment_sha256":"9e4765b16cc40a144ffe10bf075720f6f7d5ee8909629bd7812de93b915a084a","locale":"zh-Hans","page_key":"libpq-connect.html","source_hash":"1555b03a2bc480920a9c72be9683ee3ddf99e8a5c17267c0dca73c42cd50e44c","source_revision":"unknown:rendered-translation-baseline","translated_from_revision":null,"translation_revision":"git:b1b500221dbe5437cfca004d6b04d3f6e422765d;html-sha256:08e987a66af27b98444a8057c256314eafa13611a3fb9e888214fc436824244b","url":"/zh/docs/18/libpq-connect.html#LIBPQ-CONNECT-SSLCERTMODE","version":"18"},"runtime_rerun":false,"source_facts_revision":"ee8d1a3612338fd9adf250730cb640fcc5233b5491337cc00a316a44e3a0b9f8"}},"ManualEvidence":{"manual_path":"libpq-connect.html#LIBPQ-CONNECT-SSLCERTMODE","release":{"channel":"stable","evidence_kind":"English manual and source declarations","label":"18.6","major":"18","manifest":{"index":"index.html","major":"18","pages":1148,"pdf":{"A4":{"built_at":"2026-09-26","bytes":15865106,"pages":3154,"sha256":"19512c405da53f9f7fcf0abba359223aa65f021be025bf3411381918f92e3190","url":"/files/documentation/pdf/18/postgresql-18-A4.pdf"},"US":{"built_at":"2026-09-26","bytes":15748059,"pages":3328,"sha256":"facbe6c229e598b872d3d98bef53308f46e06746006fa4590de9a7de9dd46319","url":"/files/documentation/pdf/18/postgresql-18-US.pdf"}},"release":"18.6","source_mode":"en SGML built with pinned official archive","source_sha256":"555610c24d53e4316da5b7d3fc25c279d96856d5e0e23ee308c328c5fa881d9f","source_url":"https://ftp.postgresql.org/pub/source/v18.6/postgresql-18.6.tar.bz2","svg_assets":3,"tree":"18"},"ref":"https://ftp.postgresql.org/pub/source/v18.6/postgresql-18.6.tar.bz2","revision":"ee8d1a3612338fd9adf250730cb640fcc5233b5491337cc00a316a44e3a0b9f8","source_sha256":"555610c24d53e4316da5b7d3fc25c279d96856d5e0e23ee308c328c5fa881d9f"},"sources":[{"anchor":"LIBPQ-CONNECT-SSLCERTMODE","file":"libpq-connect.html","label":"18.6 English manual · libpq-connect.html","sha256":"c26a7fc3dcda6066cfe540641ae2690faf3d3c03277f30b4dfc2328ab45c212f","url":"/docs/18/libpq-connect.html#LIBPQ-CONNECT-SSLCERTMODE"},{"archive_sha256":"555610c24d53e4316da5b7d3fc25c279d96856d5e0e23ee308c328c5fa881d9f","file":"src/interfaces/libpq/fe-connect.c","label":"18.6 libpq connection option declarations","sha256":"44a6e386cbfd67ebe768d6ef5493098119c2e6b4796239d53e5ed7b122b206a5","url":"https://ftp.postgresql.org/pub/source/v18.6/postgresql-18.6.tar.bz2"},{"anchor":"","file":"libpq-envars.html","label":"18.6 English manual · libpq-envars.html","sha256":"d64db73f3d48127bb984a5f775e77b7bcca2ba4bd218333cf24a45fcdd7c4363","url":"/docs/18/libpq-envars.html"},{"anchor":"","file":"libpq-pgservice.html","label":"18.6 English manual · libpq-pgservice.html","sha256":"6035a3f0ee1d0fd80db5bf58834390b884eecd23206659bdf6f07560deea5aa7","url":"/docs/18/libpq-pgservice.html"}]},"MeasuredEvidence":{}},"Text":{"Collection":"conn","Key":"sslcertmode","SourceDatabase":"center","Version":"18","Locale":"en","Title":"sslcertmode","Summary":"This option determines whether a client certificate may be sent to the server, and whether the server is required to request one. There are three modes:","BodyHTML":"\u003cdiv\u003e\u003cdl\u003e\u003cdt id=\"LIBPQ-CONNECT-SSLCERTMODE\"\u003e\u003cspan\u003e\u003ccode\u003esslcertmode\u003c/code\u003e\u003c/span\u003e \u003c/dt\u003e\u003cdd\u003e\n\u003cp\u003eThis option determines whether a client certificate may be sent to the server, and whether the server is required to request one. There are three modes:\u003c/p\u003e\n\u003cdiv\u003e\n\u003cdl\u003e\n\u003cdt\u003e\u003cspan\u003e\u003ccode\u003edisable\u003c/code\u003e\u003c/span\u003e\u003c/dt\u003e\n\u003cdd\u003e\n\u003cp\u003eA client certificate is never sent, even if one is available (default location or provided via \u003ca href=\"/docs/18/libpq-connect.html#LIBPQ-CONNECT-SSLCERT\" rel=\"nofollow\"\u003esslcert\u003c/a\u003e).\u003c/p\u003e\n\u003c/dd\u003e\n\u003cdt\u003e\u003cspan\u003e\u003ccode\u003eallow\u003c/code\u003e (default)\u003c/span\u003e\u003c/dt\u003e\n\u003cdd\u003e\n\u003cp\u003eA certificate may be sent, if the server requests one and the client has one to send.\u003c/p\u003e\n\u003c/dd\u003e\n\u003cdt\u003e\u003cspan\u003e\u003ccode\u003erequire\u003c/code\u003e\u003c/span\u003e\u003c/dt\u003e\n\u003cdd\u003e\n\u003cp\u003eThe server \u003cspan\u003e\u003cem\u003emust\u003c/em\u003e\u003c/span\u003e request a certificate. The connection will fail if the client does not send a certificate and the server successfully authenticates the client anyway.\u003c/p\u003e\n\u003c/dd\u003e\n\u003c/dl\u003e\n\u003c/div\u003e\n\u003cdiv\u003e\n\u003ch3\u003eNote\u003c/h3\u003e\n\u003cp\u003e\u003ccode\u003esslcertmode=require\u003c/code\u003e doesn\u0026#39;t add any additional security, since there is no guarantee that the server is validating the certificate correctly; PostgreSQL servers generally request TLS certificates from clients whether they validate them or not. The option may be useful when troubleshooting more complicated TLS setups.\u003c/p\u003e\n\u003c/div\u003e\n\u003c/dd\u003e\u003c/dl\u003e\u003c/div\u003e","SourceRevision":"ee8d1a3612338fd9adf250730cb640fcc5233b5491337cc00a316a44e3a0b9f8","ContentHash":"49dce41452c57e2134e1db88b80466d3e18f7daff5aa0746a250ee6e71dc29f0","Payload":{"description":["This option determines whether a client certificate may be sent to the server, and whether the server is required to request one. There are three modes:"],"manual_html":"\u003cdiv\u003e\u003cdl class=\"variablelist\"\u003e\u003cdt id=\"LIBPQ-CONNECT-SSLCERTMODE\"\u003e\u003cspan class=\"term\"\u003e\u003ccode class=\"literal\"\u003esslcertmode\u003c/code\u003e\u003c/span\u003e \u003c/dt\u003e\u003cdd\u003e\n\u003cp\u003eThis option determines whether a client certificate may be sent to the server, and whether the server is required to request one. There are three modes:\u003c/p\u003e\n\u003cdiv class=\"variablelist\"\u003e\n\u003cdl class=\"variablelist\"\u003e\n\u003cdt\u003e\u003cspan class=\"term\"\u003e\u003ccode class=\"literal\"\u003edisable\u003c/code\u003e\u003c/span\u003e\u003c/dt\u003e\n\u003cdd\u003e\n\u003cp\u003eA client certificate is never sent, even if one is available (default location or provided via \u003ca class=\"xref\" href=\"/docs/18/libpq-connect.html#LIBPQ-CONNECT-SSLCERT\"\u003esslcert\u003c/a\u003e).\u003c/p\u003e\n\u003c/dd\u003e\n\u003cdt\u003e\u003cspan class=\"term\"\u003e\u003ccode class=\"literal\"\u003eallow\u003c/code\u003e (default)\u003c/span\u003e\u003c/dt\u003e\n\u003cdd\u003e\n\u003cp\u003eA certificate may be sent, if the server requests one and the client has one to send.\u003c/p\u003e\n\u003c/dd\u003e\n\u003cdt\u003e\u003cspan class=\"term\"\u003e\u003ccode class=\"literal\"\u003erequire\u003c/code\u003e\u003c/span\u003e\u003c/dt\u003e\n\u003cdd\u003e\n\u003cp\u003eThe server \u003cspan class=\"emphasis\"\u003e\u003cem\u003emust\u003c/em\u003e\u003c/span\u003e request a certificate. The connection will fail if the client does not send a certificate and the server successfully authenticates the client anyway.\u003c/p\u003e\n\u003c/dd\u003e\n\u003c/dl\u003e\n\u003c/div\u003e\n\u003cdiv class=\"note\"\u003e\n\u003ch3 class=\"title\"\u003eNote\u003c/h3\u003e\n\u003cp\u003e\u003ccode class=\"literal\"\u003esslcertmode=require\u003c/code\u003e doesn't add any additional security, since there is no guarantee that the server is validating the certificate correctly; PostgreSQL servers generally request TLS certificates from clients whether they validate them or not. The option may be useful when troubleshooting more complicated TLS setups.\u003c/p\u003e\n\u003c/div\u003e\n\u003c/dd\u003e\u003c/dl\u003e\u003c/div\u003e","related":[{"label":"Connection service file","url":"/docs/18/libpq-pgservice.html"},{"label":"Password file","url":"/docs/18/libpq-pgpass.html"},{"label":"All libpq environment variables","url":"/docs/18/libpq-envars.html"}],"sections":[{"paragraphs":["The following environment variables can be used to select default connection parameter values, which will be used by PQconnectdb , PQsetdbLogin and PQsetdb if no value is directly specified by the calling code. These are useful to avoid hard-coding database connection information into simple client applications, for example.","Service names can be defined in either a per-user service file or a system-wide file. If the same service name exists in both the user and the system file, the user file takes precedence. By default, the per-user service file is named ~/.pg_service.conf . On Microsoft Windows, it is named %APPDATA%\\postgresql\\.pg_service.conf (where %APPDATA% refers to the Application Data subdirectory in the user's profile). A different file name can be specified by setting the environment variable PGSERVICEFILE . The system-wide file is named pg_service.conf . By default it is sought in the etc directory of the PostgreSQL installation (use pg_config --sysconfdir to identify this directory precisely). Another directory, but not a different file name, can be specified by setting the environment variable PGSYSCONFDIR .","Connection parameters obtained from a service file are combined with parameters obtained from other sources. A service file setting overrides the corresponding environment variable, and in turn can be overridden by a value given directly in the connection string. For example, using the above service file, a connection string service=mydb port=5434 will use host somehost , port 5434 , user admin , and other parameters as set by environment variables or built-in defaults."],"title":"Default resolution and service-file precedence"},{"paragraphs":["PGSSLCERTMODE behaves the same as the sslcertmode connection parameter."],"title":"Environment variable evidence"}],"tables":[{"columns":[{"key":"name","label":"Variable"},{"key":"description","label":"Documented behavior"}],"key":"environment","rows":[{"description":"PGSSLCERTMODE behaves the same as the sslcertmode connection parameter.","name":{"text":"PGSSLCERTMODE","url":"/docs/18/libpq-envars.html"}}],"title":"Environment fallback"}]}},"RequestedLocale":"en","Fallback":false,"Versions":["16","17","18","19","20"],"Locales":["en","zh-Hans"],"Signatures":null,"Spellings":null,"SQLState":null,"Evidence":null}