Charmed PostgreSQL VM

Channel Revision Published Runs on
latest/stable 345 09 Nov 2023
Ubuntu 22.04 Ubuntu 20.04 Ubuntu 18.04 Ubuntu 16.04 Ubuntu 14.04
latest/stable 239 09 Feb 2022
Ubuntu 22.04 Ubuntu 20.04 Ubuntu 18.04 Ubuntu 16.04 Ubuntu 14.04
latest/stable 226 01 Apr 2021
Ubuntu 22.04 Ubuntu 20.04 Ubuntu 18.04 Ubuntu 16.04 Ubuntu 14.04
14/stable 430 28 Jun 2024
Ubuntu 22.04
14/stable 429 28 Jun 2024
Ubuntu 22.04
14/candidate 429 26 Jun 2024
Ubuntu 22.04
14/candidate 430 26 Jun 2024
Ubuntu 22.04
14/beta 430 26 Jun 2024
Ubuntu 22.04
14/beta 429 26 Jun 2024
Ubuntu 22.04
14/edge 436 10 Jul 2024
Ubuntu 22.04
14/edge 435 10 Jul 2024
Ubuntu 22.04
juju deploy postgresql --channel 14/stable
Show information


22.04 20.04 18.04 16.04 14.04

Charmed PostgreSQL VM Tutorial > 6. Enable encryption with TLS

Enable encryption with TLS

Transport Layer Security (TLS) is a protocol used to encrypt data exchanged between two applications. Essentially, it secures data transmitted over a network.

Typically, enabling TLS internally within a highly available database or between a highly available database and client/server applications requires a high level of expertise. This has all been encoded into Charmed PostgreSQL so that configuring TLS requires minimal effort on your end.

TLS is enabled by integrating Charmed PostgreSQL with the Self Signed Certificates Charm. This charm centralises TLS certificate management consistently and handles operations like providing, requesting, and renewing TLS certificates.

In this section, you will learn how to enable security in your PostgreSQL deployment using TLS encryption.

Self-signed certificates are not recommended for a production environment.

Check this guide for an overview of the TLS certificates charms available.


Deploy TLS charm

Before enabling TLS on Charmed PostgreSQL VM, we must deploy the self-signed-certificates charm:

juju deploy self-signed-certificates --config ca-common-name="Tutorial CA"

Wait until the self-signed-certificates is up and active, use juju status --watch 1s to monitor the progress:

Model     Controller  Cloud/Region         Version  SLA          Timestamp
tutorial  overlord    localhost/localhost  3.1.7    unsupported  10:31:40+01:00

App                        Version  Status  Scale  Charm                      Channel    Rev  Exposed  Message
postgresql                          active      2  postgresql                 14/stable  281  no       
self-signed-certificates            active      1  self-signed-certificates   stable     72   no       

Unit                          Workload  Agent  Machine  Public address  Ports  Message
postgresql/0*                 active    idle   0           Primary
postgresql/1                  active    idle   1           
self-signed-certificates/0*   active    idle   3           

Machine  State    Address       Inst id        Series  AZ  Message
0        started  juju-a8a31d-0  jammy       Running
1        started  juju-a8a31d-1  jammy       Running
4        started  juju-a8a31d-3  jammy       Running

Integrate with PostgreSQL

To enable TLS on Charmed PostgreSQL VM, integrate the two applications:

juju integrate postgresql self-signed-certificates

Check the TLS certificate in use

Use openssl to connect to the PostgreSQL and check the TLS certificate in use. Note that your leader unit’s IP address will likely be different to the one shown below:

> openssl s_client -starttls postgres -connect | grep Issuer
depth=1 C = US, CN = Tutorial CA
verify error:num=19:self-signed certificate in certificate chain

Congratulations! PostgreSQL is now using TLS certificate generated by the external application self-signed-certificates.

Remove TLS certificate

To remove the external TLS, remove the integration:

juju remove-relation postgresql self-signed-certificates

If you once again check the TLS certificates in use via the OpenSSL client, you will see something similar to the output below:

> openssl s_client -starttls postgres -connect
no peer certificate available
No client certificate CA names sent

The Charmed PostgreSQL VM application is not using TLS anymore.

Next step: 7. Clean up environment

Help improve this document in the forum (guidelines). Last updated 2 months ago.