Parameter · Connections and Authentication / SSL
ssl_cert_file
Location of the SSL server certificate file.
- Default:
server.crt - Type: string
- Applies: Reload
In plain words
The file holding the server's certificate (its public "ID card"), sent to every client that connects with TLS. The default server.crt is looked up in the data directory.
For DBAs and operators
Relative paths are relative to the data directory. The file may contain the server certificate followed by intermediate CA certificates (a chain), which clients need when they only trust the root CA. The certificate must match ssl_key_file; a mismatch gives FATAL: could not load private key file "server.key": key values mismatch.
For sslmode=verify-full clients, the certificate's Subject Alternative Name (or CN) must match the host name they connect to. Debian/Ubuntu default configs point this at /etc/ssl/certs/ssl-cert-snakeoil.pem, a self-signed certificate that verify-ca/verify-full clients will reject.
Certificate renewal: replace the file and SELECT pg_reload_conf();; new connections use the new certificate, existing sessions keep theirs. Check expiry with openssl x509 -enddate -noout -in server.crt.
How to change it
Change in postgresql.conf or ALTER SYSTEM, then run SELECT pg_reload_conf().