Re: Proposal: Supporting URI SAN in Certificate Authentication

Thanks, Olivier, for proposing it, and thanks, David, for replying (I had
lost this thread before).

I would also like to express strong support for this proposal.

As SPIFFE/SPIRE adoption continues to grow, having native support for URI
SANs in PostgreSQL certificate authentication would be a huge step forward
for modern workload identity management. Both SPIFFE and SPIRE are
graduated CNCF projects, and there is already clear interest in integrating
them across the cloud-native ecosystem.

For instance, within CloudNativePG (also a CNCF project), there is a strong
interest in supporting workload identities provided by SPIFFE/SPIRE:
https://github.com/cloudnative-pg/cloudnative-pg/discussions/6421

Having native support at the PostgreSQL level would make zero-trust
identity integration much cleaner and more seamless across operators and
surrounding tools.

Ciao,
Gabriele

On Fri, 21 Aug 2026 at 11:35, David Steele <david(at)pgbackrest(dot)org> wrote:

> On 3/27/26 20:20, olivier cano wrote:
> >
> > Proposal: Allow certificate authentication to use URI SAN entries as the
> > client identity (e.g. via a clientname=uri option in pg_hba.conf), in
> > addition to the existing CN/DN options.
> >
> > Questions:
> > * Is there interest in this feature from the community?
> This was recently requested for the pgBackRest project [1] so there does
> seem to be some interest from users, at least.
>
> The user decided to fallback to using CNs since Postgres support does
> not seem like it will happen soon and we are unlikely to add it in
> pgBackRest until it is supported by Postgres.
>
> Regards,
> -David
>
> [1] https://github.com/pgbackrest/pgbackrest/issues/2765
>
>
>

--
Gabriele Bartolini
VP, Chief Architect, Kubernetes
enterprisedb.com / Melbourne, Australia