MTLS between kong and postgres

Sudhir_Jaiswal · April 23, 2025, 11:12am

Do we have support for MTLS in kong OSS with Postgresql?
i saw this Configuring PostgreSQL TLS - Kong Gateway | Kong Docs configuration but it is not available in OSS kong.conf ,and it is nowhere written in doc?

matu · May 9, 2025, 4:07pm

As far as I understand the code, mTLS is indeed not possible in the OSS version.

You can enable TLS to postgres by setting these environment variables:

KONG_PG_SSL=on
KONG_PG_SSL_VERIFY=on
KONG_PG_SSL_VERSION=tlsv1_3

and you can also validate the server-certificate by adding these env variables:

KONG_PG_SSL_REQUIRED=on
KONG_LUA_SSL_TRUSTED_CERTIFICATE=/path-to-your-database-truststore.pem

but the settings for mTLS client-certificate and key, as described for the Enterprise version, seems to be ignored by the OSS code.

The reason can be seen in the Kong code in the postgres connector here:

github.com/Kong/kong

kong/db/strategies/postgres/connector.lua

master


      
              return nil, err
            end
          
            return true
          end
          
          
          local _M = {}
          
          
          function _M.new(kong_config)
            local config = {
              application_name = "kong",
              host        = kong_config.pg_host,
              port        = kong_config.pg_port,
              timeout     = kong_config.pg_timeout,
              user        = kong_config.pg_user,
              password    = kong_config.pg_password,
              database    = kong_config.pg_database,
              schema      = kong_config.pg_schema or "",
              ssl         = kong_config.pg_ssl,

The settings for “cert” and “key” are never initialised.

However if you are developer and are able to extend the Lua code, a workaround is quite simple. Kong uses the “pgmoon” library.
Just add the missing lines as described in the ssl-example on the “pgmoon” githab page:

Topic		Replies	Views
mTLS two way auth db - Kong kong-gateway	3	802	December 18, 2021
Postgres with SSL not working kong community Rocky Linux 9 Questions	0	127	May 7, 2024
Lack of documentation: mTLS between client app and Kong and upstream kong-gateway	3	736	November 11, 2021
Kong:3.2.2, Postgres 15.5, SSL/TLS	0	133	January 19, 2024
Kong Enterprise 2.5.0 Fails with Postgres TLS1.1 or TLS1.2 Questions	0	537	August 26, 2021

MTLS between kong and postgres

Related topics