databasus--databasus/backend/internal/features/tests/logical/postgresql/testdata/mtls/README.md

mTLS test certificates

Certificate chain for the test-logical-postgres-mtls container, which enforces mutual TLS - it rejects any TCP client that does not present a client certificate signed by ca.crt. This reproduces a Cloud SQL instance with "Require trusted client certificates" enabled. Not used in production.

• ca.crt / ca.key - test certificate authority that signs the server and client certs
• server.crt / server.key - server cert, CA-signed, CN=localhost, SAN localhost,127.0.0.1
• client.crt / client.key - client cert, CA-signed, CN=testuser
• pg_hba.conf - requires clientcert=verify-ca on every TLS connection

The container mounts ca.crt as ssl_ca_file; the backup/restore tests pass client.crt, client.key, and ca.crt through the database API.

To regenerate (run from this directory, requires Bash for the SAN process substitution):

openssl req -x509 -newkey rsa:2048 -keyout ca.key -out ca.crt -days 3650 -nodes \
  -subj "/CN=Databasus Test CA"

openssl req -newkey rsa:2048 -keyout server.key -out server.csr -nodes \
  -subj "/CN=localhost"
openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key -CAcreateserial \
  -out server.crt -days 3650 \
  -extfile <(printf "subjectAltName=DNS:localhost,IP:127.0.0.1")

openssl req -newkey rsa:2048 -keyout client.key -out client.csr -nodes \
  -subj "/CN=testuser"
openssl x509 -req -in client.csr -CA ca.crt -CAkey ca.key -CAcreateserial \
  -out client.crt -days 3650

rm server.csr client.csr ca.srl