3.5. Configuring TLS encryption on a PostgreSQL server

Procedure

1. Store the private key and the server certificate in the /var/lib/pgsql/data/ directory:

   # cp server.{key,crt} /var/lib/pgsql/data/

2. Set the ownership of the private key and certificate:

   # chown postgres:postgres /var/lib/pgsql/data/server.{key,crt}

3. Set permissions on the server certificate that enable only the PostgreSQL server to read the file:

   # chmod 0400 /var/lib/pgsql/data/server.key

   Because certificates are part of the communication before a secure connection is established, any client can retrieve them without authentication. Therefore, you do not need to set strict permissions on the server certificate file.

4. Edit the /var/lib/pgsql/data/postgresql.conf file and make the following changes:

   1. Set the scram-sha-256 hashing algorithm:

      password_encryption = scram-sha-256

   2. Enable TLS encryption:

      ssl = on

5. Edit the /var/lib/pgsql/data/pg_hba.conf file and update the authentication entries to use TLS encryption and the scram-sha-256 hashing algorithm. For example, change host entries to hostssl to enable TLS encryption, and set the scram-sha-256 hashing algorithm in the last column:

   hostssl    all    all    192.0.2.0/24    scram-sha-256

6. Restart the postgresql service:

   # systemctl restart postgresql.service