ARTIFACTORY: Configuring mTLS Between Artifactory and PostgreSQL Using a Single Certificate

Overview

This article describes how to configure mutual TLS (mTLS) between JFrog Artifactory and PostgreSQL using a single certificate for both:

• Artifactory’s Tomcat HTTPS connector (server authentication), and

• PostgreSQL client authentication (mTLS).

Using a single certificate reduces certificate management overhead while maintaining a secure, mutually authenticated channel between Artifactory and PostgreSQL.


Prerequisites

Certificate Requirements

Required Certificates

You will use the following certificates:

Note: 

The Artifactory client certificate is used both as the HTTPS server certificate for Artifactory’s Tomcat connector and as the client certificate when Artifactory connects to PostgreSQL using mTLS.


Key File Formats

You must provide the Artifactory client key in three formats, each used by a different Artifactory component:

Why Three Key Files?

Artifactory may encrypt the key file used by the Tomcat HTTPS connector. The metadata service (which is Go‑based) cannot read encrypted key files and will fail when attempting to load them.

To avoid this:

1. Use the original PEM key for Tomcat (.key).

2. Use a PKCS#8 DER key for the JDBC driver (.pk8).

3. Maintain a separate, unencrypted PEM copy for the metadata service (.pem).

Configuration

Step 1: Configure PostgreSQL

1.1 postgresql.conf

Enable SSL and configure the CA and server certificate:

ssl = on
ssl_ca_file = '/path/to/ca.crt'
ssl_cert_file = '/path/to/pg-server.crt'
ssl_key_file = '/path/to/pg-server.key'

1.2 pg_ident.conf (Username Mapping)

Because the Artifactory certificate CN is the IP address or hostname (and not the database username), configure a username mapping:

# MAPNAME           SYSTEM-USERNAME              PG-USERNAME
map_artifactory     <ARTIFACTORY_IP_OR_HOSTNAME>   artifactory

Example:

map_artifactory     192.168.1.100                artifactory

1.3 pg_hba.conf (Client Authentication)

Require client certificates and use the mapping:

# TYPE    DATABASE     USER         ADDRESS                METHOD
hostssl   artifactory  artifactory  <ARTIFACTORY_IP>/32    cert map=map_artifactory

Example:

hostssl   artifactory  artifactory  192.168.1.100/32       cert map=map_artifactory

1.4 Reload PostgreSQL

Apply the configuration changes:

sudo systemctl reload postgresql

Step 2: Configure Artifactory

2.1 File Locations

Place the certificates and keys on the Artifactory server at the following paths:

Set ownership and permissions:

chown -R artifactory:artifactory /var/opt/jfrog/artifactory/etc/security/
chmod 600 /var/opt/jfrog/artifactory/etc/security/ssl/*.key
chmod 600 /var/opt/jfrog/artifactory/etc/security/ssl/*.pk8
chmod 600 /var/opt/jfrog/artifactory/etc/security/ssl/*.pem

2.2 system.yaml

Configure the shared database, Tomcat HTTPS connector, and metadata database URL to use the single certificate with the appropriate key format for each consumer:

configVersion: 1
shared:
  database:
    type: postgresql
    driver: org.postgresql.Driver
    url: "jdbc:postgresql://<POSTGRESQL_HOST>:5432/artifactory?ssl=true&sslmode=verify-full&sslrootcert=/var/opt/jfrog/artifactory/etc/security/keys/trusted/ca-certs.crt&sslcert=/var/opt/jfrog/artifactory/etc/security/ssl/server.crt&sslkey=/var/opt/jfrog/artifactory/etc/security/ssl/server.pk8"
    username: artifactory
    password: "<DATABASE_PASSWORD>"

artifactory:
  tomcat:
    httpsConnector:
      enabled: true
      port: 8443
      certificateFile: /var/opt/jfrog/artifactory/etc/security/ssl/server.crt
      certificateKeyFile: /var/opt/jfrog/artifactory/etc/security/ssl/server.key

metadata:
  database:
    url: "go:user='${shared.database.username}' password='${shared.database.password}' dbname=artifactory host=<POSTGRESQL_HOST> port=5432 sslmode=verify-full sslrootcert=/var/opt/jfrog/artifactory/etc/security/keys/trusted/ca-certs.crt sslcert=/var/opt/jfrog/artifactory/etc/security/ssl/server.crt sslkey=/var/opt/jfrog/artifactory/etc/security/ssl/server-metadata.pem"

Key points:

• The JDBC URL uses:

  • sslmode=verify-full

  • sslrootcert pointing to the CA bundle

  • sslcert pointing to server.crt

  • sslkey pointing to the PKCS#8 key server.pk8

• The Tomcat HTTPS connector uses:

  • certificateFile = server.crt

  • certificateKeyFile = server.key (PEM)

• The Metadata service Go‑style URL uses:

  • sslcert = server.crt

  • sslkey = server-metadata.pem (unencrypted PEM copy of the key)

2.3 Restart Artifactory

2.4 Check Artifactory’s health over HTTP and HTTPS:

curl
-s http://localhost:8081/artifactory/api/system/ping    
# HTTP

curl
-sk https://localhost:8443/artifactory/api/system/ping  
# HTTPS

Both commands should return:

OK


Troubleshooting

Quick Reference

Configuration Summary

Related Documentation

• System YAML Configuration

• PostgreSQL for Artifactory

• Artifactory Metadata Service database configuration

• PostgreSQL: SSL/TLS support

• PostgreSQL: Certificate Authentication