libx509pq

Overview

Requires OpenSSL 1.1.1+; GPL-3.0-or-later is explicit in source headers. EL9 default crypto policy rejects a legacy SHA-1 test fixture; SHA-256 verification passed without changing policy.

Version

Build

You can build the RPM / DEB packages for libx509pq using pig build:

pig build pkg libx509pq         # build RPM / DEB packages

Install

You can install libx509pq directly. First, make sure the PGDG and PIGSTY repositories are added and enabled:

pig repo add pgsql -u          # Add repo and update cache

Install the extension using pig or apt/yum/dnf:

pig install libx509pq;          # Install for current active PG version

pig ext install -y libx509pq -v 18  # PG 18
pig ext install -y libx509pq -v 17  # PG 17
pig ext install -y libx509pq -v 16  # PG 16
pig ext install -y libx509pq -v 15  # PG 15
pig ext install -y libx509pq -v 14  # PG 14

dnf install -y libx509pq_18       # PG 18
dnf install -y libx509pq_17       # PG 17
dnf install -y libx509pq_16       # PG 16
dnf install -y libx509pq_15       # PG 15
dnf install -y libx509pq_14       # PG 14

apt install -y postgresql-18-libx509pq   # PG 18
apt install -y postgresql-17-libx509pq   # PG 17
apt install -y postgresql-16-libx509pq   # PG 16
apt install -y postgresql-15-libx509pq   # PG 15
apt install -y postgresql-14-libx509pq   # PG 14

Create Extension:

CREATE EXTENSION libx509pq;

Usage

Sources:

• Upstream README at the reviewed commit
• Version 1.3 SQL objects
• OpenSSL-backed implementation

libx509pq exposes OpenSSL X.509 certificate parsing to SQL. It accepts DER certificates as bytea and extracts subject, issuer, validity, serial number, key and signature information, extensions, alternate names, fingerprints, and related fields.

CREATE EXTENSION libx509pq;
SELECT x509_commonName(der),
       x509_issuerName(der),
       x509_notBefore(der),
       x509_notAfter(der),
       x509_keyAlgorithm(der),
       x509_keySize(der)
FROM certificate_store;

For multiple basic fields, x509_basic_info(der) avoids parsing the same certificate repeatedly. Other APIs enumerate extensions and names, expose public keys, identify selected weak-key patterns, and verify one certificate signature against a supplied key.

Parsing or signature verification is not full PKIX path validation: it does not by itself establish trust, hostname validity, revocation status, policy, or current acceptability. Malformed DER reaches native OpenSSL code; cap input size, fuzz and regression-test untrusted corpora, and keep PostgreSQL and OpenSSL patched. Pin the OpenSSL ABI used at build and runtime, review sentinel-versus-null error behavior, restrict expensive functions, and benchmark bulk parsing.