libx509pq

libx509pq : X.509 certificate parsing and inspection through OpenSSL

Overview

Packages

Source

pig build pkg libx509pq;		# build rpm/deb

Install

Make sure PGDG and PIGSTY repo available:

pig repo add pgsql -u   # add both repo and update cache

Install this extension with pig:

pig install libx509pq;		# install via package name, for the active PG version

pig install libx509pq -v 18;   # install for PG 18
pig install libx509pq -v 17;   # install for PG 17
pig install libx509pq -v 16;   # install for PG 16
pig install libx509pq -v 15;   # install for PG 15
pig install libx509pq -v 14;   # install for PG 14

Create this extension with:

CREATE EXTENSION libx509pq;

Usage

Sources:

• Upstream README at the reviewed commit
• Version 1.3 SQL objects
• OpenSSL-backed implementation

libx509pq exposes OpenSSL X.509 certificate parsing to SQL. It accepts DER certificates as bytea and extracts subject, issuer, validity, serial number, key and signature information, extensions, alternate names, fingerprints, and related fields.

CREATE EXTENSION libx509pq;
SELECT x509_commonName(der),
       x509_issuerName(der),
       x509_notBefore(der),
       x509_notAfter(der),
       x509_keyAlgorithm(der),
       x509_keySize(der)
FROM certificate_store;

For multiple basic fields, x509_basic_info(der) avoids parsing the same certificate repeatedly. Other APIs enumerate extensions and names, expose public keys, identify selected weak-key patterns, and verify one certificate signature against a supplied key.

Parsing or signature verification is not full PKIX path validation: it does not by itself establish trust, hostname validity, revocation status, policy, or current acceptability. Malformed DER reaches native OpenSSL code; cap input size, fuzz and regression-test untrusted corpora, and keep PostgreSQL and OpenSSL patched. Pin the OpenSSL ABI used at build and runtime, review sentinel-versus-null error behavior, restrict expensive functions, and benchmark bulk parsing.