title: psql Client Certificate Chain
body: <p>I'm trying to set up a PostgreSQL db server with ssl.  Or more specifically, I've successfully set up the server and ssl is working... as long as there are no intermediate certificates.  It's not working if there is an intermediate cert.</p>
  
  <p><strong>Background / Setup:</strong></p>
  
  <ul>
  <li>I have a root <code>CA.cert</code>.</li>
  <li>I used the CA to sign an <code>intermediate.csr</code> and create an <code>intermediate.cert</code>.</li>
  <li>I used the intermediate.cert to sign a <code>postgres.csr</code> and create a <code>postgres.cert</code>. </li>
  <li>The <code>CA.cert</code>, <code>postgres.key</code> and <code>postgres.cert</code> have been installed on the server.</li>
  <li>The <code>CA.cert</code> has been set as a trusted certificate.</li>
  <li><code>postgresql.conf</code> has been modified to point to the above files.</li>
  <li>I used the <code>intermediate.cert</code> to sign a <code>client_0.csr</code> and create a <code>client_0.cert</code>.</li>
  <li>I used the <code>CA.cert</code> to sign a <code>client_1.csr</code> and create a <code>client_1.cert</code>.</li>
  <li>I create a client <code>chain.cert</code>: <code>cat client_0.cert intermediate.cert &gt; chain.cert</code></li>
  </ul>
  
  <p>Proper extensions have been used, both client certs have their common name set to the (username) of the db being connected to.</p>
  
  <p><strong>Fun</strong>, aka <strong>The Problem.</strong></p>
  
  <p><code>psql "sslmode=require hostname=(host) db=(db) sslcert=client_1.cert sslkey=client_1.key" -U (username)</code>: Great success!</p>
  
  <p><code>psql "sslmode=require hostname=(host) db=(db) sslcert=client_0.cert sslkey=client_0.key" -U (username)</code>: <code>alert unknown ca</code>.  This is expected, <code>client_0.cert</code> is not signed by <code>CA.cert</code>.</p>
  
  <p><code>psql "sslmode=require hostname=(host) db=(db) sslcert=chain.cert sslkey=client_0.key" -U (username)</code>: <code>alert unknown ca</code>.  Uh oh.</p>
  
  <p><strong>Confusion</strong></p>
  
  <p>Documentation for connecting to a postgresql instance with ssl enabled and intermediate certificates present:</p>
  
  <blockquote>
    <p>In some cases, the client certificate might be signed by an
    "intermediate" certificate authority, rather than one that is directly
    trusted by the server. To use such a certificate, append the
    certificate of the signing authority to the postgresql.crt file, then
    its parent authority's certificate, and so on up to a certificate
    authority, "root" or "intermediate", that is trusted by the server,
    i.e. signed by a certificate in the server's root.crt file.
    <a href="https://www.postgresql.org/docs/9.6/static/libpq-ssl.html" rel="nofollow noreferrer">https://www.postgresql.org/docs/9.6/static/libpq-ssl.html</a></p>
  </blockquote>
  
  <p>I have also tried cat-ing the full chain, <code>client inter ca &gt; chain</code> , nothing doing.</p>
  
  <p><strong>Question</strong></p>
  
  <p>What have I done wrong here?</p>
  
  <p>Thank you,</p>