Parameter · Connections and Authentication / SSL
ssl_ca_file
Location of the SSL certificate authority file.
- Default:
'' (empty) - Type: string
- Applies: Reload
In plain words
The list of certificate authorities the server trusts when clients present their own certificates. Needed only if you use client-certificate login (cert) or clientcert= in pg_hba.conf. Empty by default.
For DBAs and operators
Relative paths are relative to the data directory. When set, the server requests a client certificate during the handshake and verifies any certificate it receives against these CAs. It does not by itself require clients to have one: that is done per pg_hba.conf line, with auth-method cert (certificate CN must match the role, or a map) or clientcert=verify-ca/verify-full on other methods.
If pg_hba.conf requires a client certificate but this is empty, matching connections fail with FATAL: client certificates can only be checked if a root certificate store is available. A client with an untrusted certificate typically fails with could not accept SSL connection: certificate verify failed in the server log.
The CA file does not need to be the same CA that signed the server certificate; a common setup is a public CA for ssl_cert_file and a private CA here for client certificates.
How to change it
Change in postgresql.conf or ALTER SYSTEM, then run SELECT pg_reload_conf().