How to fix Could not load server certificate file in PostgreSQL

If SSL is not required for your use case, the simplest solution is to disable it:

ssl = off

Edit postgresql.conf in the PGDATA directory (usually /var/lib/postgresql/data or /etc/postgresql/) and set ssl = off. Then restart PostgreSQL. This is appropriate for development environments or systems using other security measures.

Check if the server.crt and server.key files exist in the expected location (PGDATA directory by default):

ls -la /var/lib/postgresql/data/server.crt
ls -la /var/lib/postgresql/data/server.key

If using custom paths, check the ssl_cert_file and ssl_key_file values in postgresql.conf:

grep "ssl_cert_file\|ssl_key_file" /var/lib/postgresql/data/postgresql.conf

If files don't exist, you need to generate self-signed certificates or restore them from backup (steps below).

If certificates don't exist, create a self-signed certificate valid for 365 days. Replace "dbhost.yourdomain.com" with your actual hostname:

openssl req -new -x509 -days 365 -nodes -text -out server.crt \
  -keyout server.key -subj "/CN=dbhost.yourdomain.com"

On Linux/macOS, run this in a temporary directory, then move files to PGDATA:

mv server.crt /var/lib/postgresql/data/
mv server.key /var/lib/postgresql/data/

For Docker PostgreSQL containers, run this command inside the container or mount the certificates from the host.

PostgreSQL requires strict permissions on certificate files for security. Set ownership and permissions correctly:

sudo chown postgres:postgres /var/lib/postgresql/data/server.crt
sudo chown postgres:postgres /var/lib/postgresql/data/server.key
sudo chmod 600 /var/lib/postgresql/data/server.crt
sudo chmod 600 /var/lib/postgresql/data/server.key

The postgres user must own the files, and they should be readable/writable only by the postgres user (0600 mode). Never make these files world-readable or group-readable.

Ensure the certificate is in PEM format (text-based, starts with "-----BEGIN CERTIFICATE-----"):

head -1 /var/lib/postgresql/data/server.crt

Should output:

-----BEGIN CERTIFICATE-----

For server.key, it should start with:

-----BEGIN PRIVATE KEY-----

If the file is binary or corrupted, regenerate it using the openssl command from step 3.

Ensure postgresql.conf has correct ssl_cert_file and ssl_key_file settings. Default values assume files are in PGDATA:

grep -A 5 "^ssl = " /var/lib/postgresql/data/postgresql.conf

If using custom paths, verify they're absolute paths:

ssl = on
ssl_cert_file = '/var/lib/postgresql/data/server.crt'
ssl_key_file = '/var/lib/postgresql/data/server.key'

After editing, restart PostgreSQL:

sudo systemctl restart postgresql
# or for Docker:
docker restart <container_id>