@@ -222,6 +222,7 @@ def _parse_hostlist(hostlist, port, *, unquote=False):
222
222
223
223
def _parse_connect_dsn_and_args (* , dsn , host , port , user ,
224
224
password , passfile , database , ssl ,
225
+ sslcert , sslkey , sslrootcert , sslcrl ,
225
226
connect_timeout , server_settings ):
226
227
# `auth_hosts` is the version of host information for the purposes
227
228
# of reading the pgpass file.
@@ -310,6 +311,26 @@ def _parse_connect_dsn_and_args(*, dsn, host, port, user,
310
311
if ssl is None :
311
312
ssl = val
312
313
314
+ if 'sslcert' in query :
315
+ val = query .pop ('sslcert' )
316
+ if sslcert is None :
317
+ sslcert = val
318
+
319
+ if 'sslkey' in query :
320
+ val = query .pop ('sslkey' )
321
+ if sslkey is None :
322
+ sslkey = val
323
+
324
+ if 'sslrootcert' in query :
325
+ val = query .pop ('sslrootcert' )
326
+ if sslrootcert is None :
327
+ sslrootcert = val
328
+
329
+ if 'sslcrl' in query :
330
+ val = query .pop ('sslcrl' )
331
+ if sslcrl is None :
332
+ sslcrl = val
333
+
313
334
if query :
314
335
if server_settings is None :
315
336
server_settings = query
@@ -427,7 +448,6 @@ def _parse_connect_dsn_and_args(*, dsn, host, port, user,
427
448
'`sslmode` parameter must be one of: {}' .format (modes ))
428
449
429
450
# docs at https://www.postgresql.org/docs/10/static/libpq-connect.html
430
- # Not implemented: sslcert & sslkey & sslrootcert & sslcrl params.
431
451
if sslmode < SSLMode .allow :
432
452
ssl = False
433
453
else :
@@ -436,6 +456,28 @@ def _parse_connect_dsn_and_args(*, dsn, host, port, user,
436
456
ssl .verify_mode = ssl_module .CERT_REQUIRED
437
457
if sslmode <= SSLMode .require :
438
458
ssl .verify_mode = ssl_module .CERT_NONE
459
+
460
+ if sslcert is None :
461
+ sslcert = os .getenv ('PGSSLCERT' )
462
+
463
+ if sslkey is None :
464
+ sslkey = os .getenv ('PGSSLKEY' )
465
+
466
+ if sslrootcert is None :
467
+ sslrootcert = os .getenv ('PGSSLROOTCERT' )
468
+
469
+ if sslcrl is None :
470
+ sslcrl = os .getenv ('PGSSLCRL' )
471
+
472
+ if sslcert :
473
+ ssl .load_cert_chain (sslcert , keyfile = sslkey )
474
+
475
+ if sslrootcert :
476
+ ssl .load_verify_locations (cafile = sslrootcert )
477
+
478
+ if sslcrl :
479
+ ssl .load_verify_locations (cafile = sslcrl )
480
+
439
481
elif ssl is True :
440
482
ssl = ssl_module .create_default_context ()
441
483
sslmode = SSLMode .verify_full
@@ -463,7 +505,8 @@ def _parse_connect_arguments(*, dsn, host, port, user, password, passfile,
463
505
statement_cache_size ,
464
506
max_cached_statement_lifetime ,
465
507
max_cacheable_statement_size ,
466
- ssl , server_settings ):
508
+ ssl , sslcert , sslkey , sslrootcert , sslcrl ,
509
+ server_settings ):
467
510
468
511
local_vars = locals ()
469
512
for var_name in {'max_cacheable_statement_size' ,
@@ -491,7 +534,8 @@ def _parse_connect_arguments(*, dsn, host, port, user, password, passfile,
491
534
addrs , params = _parse_connect_dsn_and_args (
492
535
dsn = dsn , host = host , port = port , user = user ,
493
536
password = password , passfile = passfile , ssl = ssl ,
494
- database = database , connect_timeout = timeout ,
537
+ sslcert = sslcert , sslkey = sslkey , sslrootcert = sslrootcert ,
538
+ sslcrl = sslcrl , database = database , connect_timeout = timeout ,
495
539
server_settings = server_settings )
496
540
497
541
config = _ClientConfiguration (
0 commit comments