Garick Hamlin <ghamlin@isc.upenn.edu> writes:
> I am guessing the problem is that validating the presented chain is hard?
No, the problem is that the current libpq code fails to present the
chain at all. It will only load and send the first cert in the
postgresql.crt file. This works only when the client's cert is signed
directly by one of the CAs trusted by the server.
regards, tom lane