Configure a TLS/SSL certificate for a device in DB Proxy PostgreSQL

By the end of this tutorial, you will have enabled TLS/SSL on a PostgreSQL device registered in Segura®, uploaded the required certificate and key files, and confirmed that the DB Proxy connection uses the configured certificate.

Prerequisites

• Access: an administrator account in PAM Core with permission to manage devices.
• Files ready: the following files in hand before starting:
  • Client certificate file (.crt).
  • Private key file (.pem).
  • (Optional) CA certificate file, if your environment requires server certificate validation.
  • (Optional) Key passphrase, if the private key is password-protected.
• Device already registered: a PostgreSQL device registered in Segura®. If you have not registered a device yet, see Device registration.
• Version: Segura® 4.2.5 or later.

The scenario

In this tutorial, you will configure TLS/SSL authentication for a PostgreSQL device named db-postgres-01. You will enable the TLS/SSL option, upload the certificate and key files, and verify that Segura® stores the configuration correctly.

Step 1 - Open the device for editing

1. On Segura®, in the navigation bar, hover over the Products menu and select PAM Core.
2. In the side menu, select Devices > All devices.
3. On the Devices screen, locate the row with the desired device, in this example db-postgres-01.
4. In the Actions column, click Edit.
   • The Device wizard opens on the Information tab.

Step 2 - Navigate to the Certificate section

1. Click the Connectivity tab at the top of the wizard.
   • The Connectivity tab loads, showing the Enable remote application usage, Network Connector, and Connectivity fields, followed by the Certificate section.
2. Scroll down to the Certificate section.
   • The section header reads Certificate and the subtitle reads Certificate for DB Proxy connection. Required if TLS/SSL connection is enabled.

Step 3 - Enable TLS/SSL

1. In the Certificate section, set Use TLS/SSL? to Yes.
   • The Certificate file and Key file upload areas become active.

Step 4 - Upload the certificate and key files

1. In the Certificate file upload area, drag your .crt file onto the area, or click the area and select the file from your file system.
2. In the Key file upload area, drag your .pem file onto the area, or click the area and select the file from your file system.
3. If your private key is password-protected, type the passphrase in the Key password field.
4. (Optional) In the Certificate CA upload area, drag your CA file onto the area, or click the area and select the file from your file system.

:::(warning) (Attention) To replace the certificate or key in the future, upload a new file in the same upload area. Segura® overwrites the previous file on save. :::

Step 5 - Save and review

1. Click Continue to advance to the Additional settings tab.
2. Click Continue again to advance to the Review tab.
3. On the Review tab, confirm that the Connectivity section shows the TLS/SSL configuration you entered.
4. Click Save.
   • Segura® saves the device with the updated certificate configuration.

Verify what you built

To confirm the certificate is stored and active:

1. On the Devices screen, click Edit on db-postgres-01.
2. Go to the Connectivity tab and scroll to the Certificate section.
3. Verify that Use TLS/SSL? is set to Yes and that the upload areas display the file names of the certificate and key you uploaded.
4. (Optional) Open a DB Proxy session to db-postgres-01 through PAM Core and confirm the connection completes without TLS errors.

:::(Info) (Info) If a credential associated with db-postgres-01 has its own certificate configured, the credential-level certificate takes precedence over the device-level certificate configured here. :::

Where to go next

• Reference: Device registration full field reference for the Device wizard, including all Connectivity tab fields.
• How-To: How to configure a device concise task guide for registering and editing devices without step-by-step hand-holding.
• How-To: How to check the device connectivity verify that Segura® can reach your device after saving changes.