tlsv1 alert unknown ca error on cert authentication

Andrus <kobruleht2@hot.ee>

From: Andrus <kobruleht2@hot.ee>
To: pgsql-bugs@lists.postgresql.org
Date: 2025-06-08T12:21:40Z
Lists: pgsql-bugs
Steps to reproduce:

1. Install Postgres 17.5 and OpenSsl on Windows 11

2. Run the following commands. Enter `postgres` as common name on client 
cert creation:

    ```sh
    openssl req -new -x509 -days 365 -nodes -out server.crt -keyout 
server.key
    openssl req -new -nodes -out client.csr -keyout client.key
    openssl x509 -req -in client.csr -CA server.crt -CAkey server.key 
-CAcreateserial -out client.crt -days 365
     ```

3. Copy files to server data directory:

     ```sh
     copy server.key "C:\Program Files\PostgreSQL\17\data"
     copy server.crt "C:\Program Files\PostgreSQL\17\data\root.crt"
     copy server.crt "C:\Program Files\PostgreSQL\17\data"

4. Add the following lines to top of `pg_hba.conf`:

        hostssl all postgres ::1/0 cert
        hostssl all postgres 0.0.0.0/0 cert

5. Add the following lines to end of `postgresql.conf`:

        ssl = on
        ssl_ca_file = 'root.crt'
        ssl_cert_file = 'server.crt'
        ssl_key_file = 'server.key'

6. Re-start postgres service

7. Run commands

     ```sh
     set PGSSLCERT=client.crt
     set PGSSLKEY=client.key
     "C:\Program Files\PostgreSQL\17\bin\pg_dump" -f "test.backup" -F c 
-h localhost -U postgres postgres


Observed:

 > pg_dump: error: connection to server at "localhost" (::1), port 5432
 > failed: SSL error: tlsv1 alert unknown ca

Postgres log contains:

 > [unknown] ::1 [unknown] LOG:  could not accept SSL connection:
 > certificate verify failed [unknown] ::1 [unknown] DETAIL: Client
 > certificate verification failed at depth 0: self-signed certificate.
 >     Failed certificate data (unverified): subject
 > "...rju/L=test/O=test/CN=postgres/emailAddress=test@example.com",
 > serial number 14465968192346824308, issuer
 > "...rju/L=test/O=test/CN=postgres/emailAddress=test@example.com"

Reported also in

https://stackoverflow.com/questions/79657806/why-postgres-17-cert-authentication-fails-in-windows

Andrus.