When deployed, Validation Authority adds the following requirements to the third-party database.

Database management system

Validation Authority supports the following Database Management Systems (DBMS).

Database storage

Calculate 75MB for every 100,000 certificates managed by the Validation Authority solution.

Database platform

Check the DBMS documentation for the DBMS requirements on each platform. In the case of PostgreSQL, we recommend downloading the official Docker image:

https://hub.docker.com/_/postgres 

If you are not using this Docker image, ensure that you install the following extensions.

To install the PostgreSQL extensions

1. Run the following command on the server hosting the database.  
   sudo dnf install postgresql17-contrib
2. Connect to the database as a user with permissions to install extensions. 
   psql -d <db_name> -U <username>
3. Run the following SQL commands to install the extensions. 

   Although usually optional, the quotes around the extension identifiers may be required in some environments.

   CREATE EXTENSION IF NOT EXISTS "lo";

   CREATE EXTENSION IF NOT EXISTS "pg_trgm";

   CREATE EXTENSION IF NOT EXISTS "uuid-ossp";
4. Run the following SQL command to check that the extensions are installed.
   SELECT * FROM pg_available_extensions WHERE name IN ('lo', 'pg_trgm', 'uuid-ossp');

Database user permissions

The database user must have permissions on the public schema (the default permissions assigned when creating the user should be sufficient). For example, to create a PostgreSQL database user with sufficient permissions, connect to PSQL using the default PostgreSQL user and execute the following commands.

Where:

• ${POSTGRES_USER} is the database user name.
• ${POSTGRES_PWD} is the database user password.
• ${POSTGRES_DB} is the database name.

Database allowed incoming connections

Restrict database incoming connections to those originating from the PKI Hub host.

To restrict incoming connections on a PostgreSQL database

1. Edit the following PostgreSQL configuration file.

   pg_hba.conf

2. Add the following line.

   hostssl cm ${POSTGRES_USER} <host> scram-sha-256

   Where <host> is the IP address of the PKI Hub host.

Database supported number of connections

The Validation Authority database must support 192 connections per cluster. 

Database TLS certificate

RFC2818 deprecates the use of the Common Name (CN) field in the Subject for hostname verification. TLS clients use the Subject Alternative Name (SAN) extension instead.