STIGQter: STIG Summary: Crunchy Data Postgres 16 Security Technical Implementation Guide Version: 1 Release: 3 Benchmark Date: 01 Jul 2026:

PostgreSQL, when using PKI-based authentication, must validate certificates by performing RFC 5280-compliant certification path validation.

DISA Rule

SV-261893r1000684_rule

Vulnerability Number

V-261893

Group Title

SRG-APP-000175-DB-000067

Rule Version

CD16-00-004000

Severity

CAT II

CCI(s)

CCI-000185 - For public key-based authentication, validate certificates by constructing and verifying a certification path to an accepted trust anchor including checking certificate status information.

Weight

Fix Recommendation

Note: The following instructions use the PGDATA and PGVER environment variables. Refer to APPENDIX-F for instructions on configuring PGDATA and APPENDIX-H for PGVER.

To configure PostgreSQL to use SSL, refer to supplementary content APPENDIX-G.

To generate a Certificate Revocation List, refer to the official Red Hat Documentation: https://access.redhat.com/documentation/en-US/Red_Hat_Update_Infrastructure/2.1/html/Administration_Guide/chap-Red_Hat_Update_Infrastructure-Administration_Guide-Certification_Revocation_List_CRL.html.

As the database administrator (shown here as "postgres"), copy the CRL file into the data directory:

As the system administrator, copy the CRL file into the PostgreSQL Data Directory:

$ sudo cp root.crl ${PGDATA?}/root.crl

As the database administrator (shown here as "postgres"), set the ssl_crl_file parameter to the filename of the CRL:

$ sudo su - postgres
$ vi ${PGDATA?}/postgresql.conf
ssl_crl_file = 'root.crl'

In pg_hba.conf, require ssl authentication:

$ sudo su - postgres
$ vi ${PGDATA?}/pg_hba.conf
hostssl <database> <user> <address> cert clientcert=verify-ca

As the system administrator, reload the server with the new configuration:

# SYSTEMD SERVER ONLY
$ sudo systemctl reload postgresql-${PGVER?}

Check Contents

Note: The following instructions use the PGDATA environment variable. Refer to APPENDIX-F for instructions on configuring PGDATA.

To verify that a CRL file exists, as the database administrator (shown here as "postgres"), run the following:

$ sudo su - postgres
$ psql -c "SELECT CASE WHEN length(setting) > 0
THEN CASE WHEN substring(setting, 1, 1) = '/'
THEN setting
ELSE (SELECT setting FROM pg_settings WHERE name = 'data_directory') || '/' || setting
END
ELSE ''
END AS ssl_crl_file
FROM pg_settings
WHERE name = 'ssl_crl_file';"

If this is not set to a CRL file, this is a finding.

Verify the existence of the CRL file by checking the directory from above:

$ sudo su - postgres
$ ls -ld <ssl_crl_file>

If the CRL file does not exist, this is a finding.

Verify that hostssl entries in pg_hba.conf have "cert" and "clientcert=verify-ca" enabled:

$ sudo su - postgres
$ grep '^hostssl.*cert.*clientcert=verify-ca ' ${PGDATA?}/pg_hba.conf

If hostssl entries are not returned, this is a finding.

If certificates are not being validated by performing RFC 5280-compliant certification path validation, this is a finding.

Vulnerability Number

V-261893

Documentable

False

Rule Version

CD16-00-004000

Severity Override Guidance

Check Content Reference

Target Key

5598