Connect to PostgreSQL server with "cert" authentication method using QSqlDatabase

Question

I need to communicate with PostgreSQL database from my Qt application, but the server uses "cert" authentication method, so I need to pass my certificates to the server.

The only solution I see for now is to obtain PGconn* like this:

QSqlDatabase db;
//.....
PGconn* conn = (PGconn*)db.driver()->handle()->data();

and do some work with it. Or even reject QSqlDatabase and use libpq directly.

Is there any other way to do this without using libpq from my code? For example, something like this:

//hypothetic QSqlDatabase methods:
QSqlDatabase db;
//.....
db.SetSslCert("/path/to/my/cert.crt");
db.SetSslKey("/path/to/my/cert.key");
//.....

QSqlDatabase is pretty limited - I wouldn't be surprised if there's no way to do this directly. — Craig Ringer
– Craig Ringer, Commented Nov 24, 2014 at 12:20

Daniel Vérité · Accepted Answer · 2014-11-25 23:36:24Z

3

I need to pass my certificates to the server.

There's no function in Qt for that because there's no equivalent function in libpq for that either. It happens automatically, as described in Client Certificates inside SSL support from libpq documentation

Excerpt:

If the server requests a trusted client certificate, libpq will send the certificate stored in file ~/.postgresql/postgresql.crt in the user's home directory. The certificate must be signed by one of the certificate authorities (CA) trusted by the server. A matching private key file ~/.postgresql/postgresql.key must also be present

(in Windows, ~/.postgresql is going to be %APPDATA%\postgresql)

The same will happen for a Qt application since the Qt's QPSQL driver is built on top of libpq. The fact that the connection uses SSL and certificates is essentially transparent even for the driver itself.

EDIT: if ~/.posgresql is not convenient as when they are multiple certificates, alternatives exist:

The location of the certificate and key files can be overridden by the connection parameters sslcert and sslkey or the environment variables PGSSLCERT and PGSSLKEY

The connection parameters are set through QSqlDatabase::setConnectOptions. Despite its doc mentioning only an handful of postgresql-specific parameters, it actually will accept any parameter, so anything supported by libpq will work.

edited Nov 25, 2014 at 23:36

answered Nov 24, 2014 at 20:28

Daniel Vérité

62.3k16 gold badges134 silver badges160 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Sergey Over a year ago

Thanks, that works. But what if I need to connect to the database under different roles, each has it's own *.crt and *.key file? Is there any solution except replacing files in ~/.postgresql/ before each connection?

Daniel Vérité Over a year ago

@Sergey: this can be overwritten through environment variables or connection parameters, see my edit

Collectives™ on Stack Overflow

Connect to PostgreSQL server with "cert" authentication method using QSqlDatabase

1 Answer 1

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related