Thanks, Olivier, for proposing it, and thanks, David, for replying (I had lost this thread before).
I would also like to express strong support for this proposal. As SPIFFE/SPIRE adoption continues to grow, having native support for URI SANs in PostgreSQL certificate authentication would be a huge step forward for modern workload identity management. Both SPIFFE and SPIRE are graduated CNCF projects, and there is already clear interest in integrating them across the cloud-native ecosystem. For instance, within CloudNativePG (also a CNCF project), there is a strong interest in supporting workload identities provided by SPIFFE/SPIRE: https://github.com/cloudnative-pg/cloudnative-pg/discussions/6421 Having native support at the PostgreSQL level would make zero-trust identity integration much cleaner and more seamless across operators and surrounding tools. Ciao, Gabriele On Fri, 21 Aug 2026 at 11:35, David Steele <[email protected]> wrote: > On 3/27/26 20:20, olivier cano wrote: > > > > Proposal: Allow certificate authentication to use URI SAN entries as the > > client identity (e.g. via a clientname=uri option in pg_hba.conf), in > > addition to the existing CN/DN options. > > > > Questions: > > * Is there interest in this feature from the community? > This was recently requested for the pgBackRest project [1] so there does > seem to be some interest from users, at least. > > The user decided to fallback to using CNs since Postgres support does > not seem like it will happen soon and we are unlikely to add it in > pgBackRest until it is supported by Postgres. > > Regards, > -David > > [1] https://github.com/pgbackrest/pgbackrest/issues/2765 > > > -- Gabriele Bartolini VP, Chief Architect, Kubernetes enterprisedb.com / Melbourne, Australia
