How to fix Could not load server certificate file in PostgreSQL

PostgreSQLINTERMEDIATEHIGHUpdated Dec 29, 2025· 175 views

PostgreSQL fails to start when SSL is enabled but the server certificate file (server.crt) is missing, unreadable, or incorrectly configured. This error prevents any SSL connections from being established. Ensure the certificate file exists in the correct location with proper permissions.

Quick fix

Fixes Could not load server certificate file

ssl = off
  1. Verify SSL is actually needed
  2. Confirm certificate file exists
  3. Generate self-signed certificates
  4. Fix file permissions
postgresql — error
ssl = off
Could not load server certificate file

What this error means

When PostgreSQL is configured with SSL/TLS enabled (ssl = on in postgresql.conf), the server attempts to load the server certificate file (server.crt) and private key (server.key) during startup. If PostgreSQL cannot find or read these files, the server will fail to start with this error. The server certificate is essential for establishing secure connections to the database—without it, SSL/TLS connections cannot be negotiated. This is a startup failure, not a runtime error, so the database becomes completely unavailable until resolved.

Typical symptoms

  • PostgreSQL service fails to start with "Could not load server certificate file" in logs
  • psql cannot connect even locally, reporting connection refused
  • PostgreSQL process terminates immediately after starting
  • Docker containers or systemd services timeout waiting for PostgreSQL to become available
  • Log shows "FATAL: could not load server certificate file" with path to missing file

Common causes

  1. The server.crt file does not exist in the data directory or the path specified in ssl_cert_file parameter
  2. Incorrect file permissions—PostgreSQL process cannot read the certificate file (typically needs 0600)
  3. File ownership mismatch—certificate files are owned by wrong user (should be owned by postgres user)
  4. Certificate file is in wrong location—by default expected in PGDATA directory, not system SSL directories
  5. Invalid certificate format—file is not in PEM format or is corrupted
  6. Typo or incorrect path in ssl_cert_file or ssl_key_file configuration parameters
  7. Certificate file exists on source but was not copied when migrating PostgreSQL to new system

How to fix "Could not load server certificate file"

1Verify SSL is actually needed

If SSL is not required for your use case, the simplest solution is to disable it:

sql
ssl = off

Edit postgresql.conf in the PGDATA directory (usually /var/lib/postgresql/data or /etc/postgresql/) and set ssl = off. Then restart PostgreSQL. This is appropriate for development environments or systems using other security measures.

2Confirm certificate file exists

Check if the server.crt and server.key files exist in the expected location (PGDATA directory by default):

bash
ls -la /var/lib/postgresql/data/server.crt
ls -la /var/lib/postgresql/data/server.key

If using custom paths, check the ssl_cert_file and ssl_key_file values in postgresql.conf:

bash
grep "ssl_cert_file\|ssl_key_file" /var/lib/postgresql/data/postgresql.conf

If files don't exist, you need to generate self-signed certificates or restore them from backup (steps below).

3Generate self-signed certificates

If certificates don't exist, create a self-signed certificate valid for 365 days. Replace "dbhost.yourdomain.com" with your actual hostname:

bash
openssl req -new -x509 -days 365 -nodes -text -out server.crt \
  -keyout server.key -subj "/CN=dbhost.yourdomain.com"

On Linux/macOS, run this in a temporary directory, then move files to PGDATA:

bash
mv server.crt /var/lib/postgresql/data/
mv server.key /var/lib/postgresql/data/

For Docker PostgreSQL containers, run this command inside the container or mount the certificates from the host.

4Fix file permissions

PostgreSQL requires strict permissions on certificate files for security. Set ownership and permissions correctly:

bash
sudo chown postgres:postgres /var/lib/postgresql/data/server.crt
sudo chown postgres:postgres /var/lib/postgresql/data/server.key
sudo chmod 600 /var/lib/postgresql/data/server.crt
sudo chmod 600 /var/lib/postgresql/data/server.key

The postgres user must own the files, and they should be readable/writable only by the postgres user (0600 mode). Never make these files world-readable or group-readable.

5Verify certificate format and content

Ensure the certificate is in PEM format (text-based, starts with "-----BEGIN CERTIFICATE-----"):

bash
head -1 /var/lib/postgresql/data/server.crt

Should output:

bash
-----BEGIN CERTIFICATE-----

For server.key, it should start with:

bash
-----BEGIN PRIVATE KEY-----

If the file is binary or corrupted, regenerate it using the openssl command from step 3.

6Verify and update postgresql.conf paths

Ensure postgresql.conf has correct ssl_cert_file and ssl_key_file settings. Default values assume files are in PGDATA:

bash
grep -A 5 "^ssl = " /var/lib/postgresql/data/postgresql.conf

If using custom paths, verify they're absolute paths:

bash
ssl = on
ssl_cert_file = '/var/lib/postgresql/data/server.crt'
ssl_key_file = '/var/lib/postgresql/data/server.key'

After editing, restart PostgreSQL:

bash
sudo systemctl restart postgresql
# or for Docker:
docker restart <container_id>

Advanced notes

Certificate Authority (CA) chains: If using certificates signed by a CA, the server.crt file must contain the full certificate chain—the server's certificate first, followed by intermediate CA certificates. The private key in server.key must match the certificate in server.crt or PostgreSQL will refuse to start.

For production systems, consider using certificates from Let's Encrypt or your organization's CA. Self-signed certificates are appropriate for development and testing but will trigger warnings in client SSL verification modes.

Docker deployments: If running PostgreSQL in Docker, either mount pre-generated certificates as volumes or generate them in an initialization script. Ensure PGDATA permissions are 700 and certificate files are 600.

Rootless PostgreSQL: If running PostgreSQL without root privileges (rootless containers or unprivileged systemd services), ensure the postgres user can read certificate files.

SSL mode compatibility: Client libraries and applications may require specific SSL modes (require, verify-ca, verify-full). Mismatches between server certificate validity and client SSL requirements can also cause connection failures. Test connections with psql using -h (TCP, not Unix socket) to verify SSL negotiation works.

Frequently asked questions

What does "Could not load server certificate file" mean?
key) during startup. If PostgreSQL cannot find or read these files, the server will fail to start with this error. The server certificate is essential for establishing secure connections to the database—without it, SSL/TLS connections cannot be negotiated.
How do I fix "Could not load server certificate file"?
PostgreSQL fails to start when SSL is enabled but the server certificate file (server.crt) is missing, unreadable, or incorrectly configured. This error prevents any SSL connections from being established. Ensure the certificate file exists in the correct location with proper permissions.
What causes "Could not load server certificate file"?
The server.crt file does not exist in the data directory or the path specified in ssl_cert_file parameter Incorrect file permissions—PostgreSQL process cannot read the certificate file (typically needs 0600) File ownership mismatch—certificate files are owned by wrong user (should be owned by postgres user)
Is the "Could not load server certificate file" error serious?
Yes. This is a high-severity error that usually blocks work until it is fixed, but the steps above resolve it.

Official resources & further reading