sslutils

Overview

PGDG packages remain absent for PG18 on EL8 x86_64.

Version

Build

You can build the RPM / DEB packages for sslutils using pig build:

pig build pkg sslutils         # build RPM / DEB packages

Install

You can install sslutils directly. First, make sure the PGDG and PIGSTY repositories are added and enabled:

pig repo add pgsql -u          # Add repo and update cache

Install the extension using pig or apt/yum/dnf:

pig install sslutils;          # Install for current active PG version

pig ext install -y sslutils -v 18  # PG 18
pig ext install -y sslutils -v 17  # PG 17
pig ext install -y sslutils -v 16  # PG 16
pig ext install -y sslutils -v 15  # PG 15
pig ext install -y sslutils -v 14  # PG 14

dnf install -y sslutils_18       # PG 18
dnf install -y sslutils_17       # PG 17
dnf install -y sslutils_16       # PG 16
dnf install -y sslutils_15       # PG 15
dnf install -y sslutils_14       # PG 14

apt install -y postgresql-18-sslutils   # PG 18
apt install -y postgresql-17-sslutils   # PG 17
apt install -y postgresql-16-sslutils   # PG 16
apt install -y postgresql-15-sslutils   # PG 15
apt install -y postgresql-14-sslutils   # PG 14

Create Extension:

CREATE EXTENSION sslutils;

Usage

Sources:

• 1.4.1 README
• 1.4.1 SQL API
• 1.4.1 control file
• File-access checks

sslutils provides SSL certificate-generation and revocation helpers for Postgres Enterprise Manager and other controlled administration workflows. Some functions read or modify files on the database server.

Install and Inspect

CREATE EXTENSION sslutils;
SELECT sslutils_version();
SELECT openssl_get_crt_expiry_date('server.crt');

A superuser must install this non-relocatable extension. No preload or PostgreSQL restart is required to call the functions; deploying generated certificates is a separate server configuration operation.

Important Functions

For self-signed generation, the certificate-path argument to the signing function is NULL and the key path selects the signing key. The optional validity defaults to 3650 days. File paths refer to the PostgreSQL server, not the SQL client’s machine.

Protect Keys and Server Files

Certificate-inspection functions require membership in pg_read_server_files on PostgreSQL 11 and later; revocation checks both that role and pg_write_server_files. These roles provide broad server-file access, so grant them only to trusted administrators and restrict function execution as needed.

Private keys returned as SQL text can enter query results, logs, shell history or application traces. Protect their handling and storage. This extension does not provide SSL session-inspection getters or automatically configure PostgreSQL’s TLS settings.

File-Access Changes in 1.4.1

Certificate inspection and CA signing paths are checked against the server data directory; place the input files there and use server-relative paths where suitable. Revocation requires sslutils.revoke_certificate_crl_paths, a comma-separated allowlist of CRL output path prefixes configured in postgresql.conf and activated by reload. The revocation check compares lexical string prefixes without resolving canonical directory containment; configure narrow prefixes and protect the output location.

The revocation implementation accepts PEM certificate text as its first argument, despite older README and SQL comments describing a certificate path. It reads the server-side CA files ca_certificate.crt and ca_key.key, and creates or appends to revoke_cert.db. Prepare the CA files before using it. Do not infer that a broad server-file role bypasses these extension-specific checks.