ruby on rails - pg gem sslmode=verify-full, where to place certificates? -

is there way pg-gem use sslmode = verify-full it's postgres connection? simple passing string in? have rails app want full ca protected ssl connections on external db , don't know how setup ca part of that. using require on sslmode defaults use ssl traffic don't know (or under user, etc.) should placing certificates verification. should place them under ~/.postgresql/ in normal psql client workflow verified ssl certs names root.crt , postgresql.cert , postgresql.key?

i'm using postgres 9.1 if helps @ all.

edit come later:

the following database.yml file seems work test on dev machine. i'll writing blog post on issue sure since such pita figure out going wrong.

  host: 127.0.0.1   sslcert: <%= rails.root.join('config', 'client.crt') %>   sslkey: <%= rails.root.join('config', 'client.key') %>   sslrootcert: <%= rails.root.join('config', 'root.crt') %>   sslmode: verify-full   database: pg-test_development   username: postgres   password: 

the pg gem uses libpq internally, same client library postgresql tools psql.

by default libpq looks in ~/.postgresql/ ca certificate.

from the manual:

to allow server certificate verification, certificate(s) of 1 or more trusted cas must placed in file ~/.postgresql/root.crt in user's home directory. (on microsoft windows file named %appdata%\postgresql\root.crt.)

... , ...

the location of root certificate file , crl can changed setting connection parameters sslrootcert , sslcrl [...]

afaik rails passes put in database.yml pg gem, passes libpq connection parameter. should able add key/value entries database.yml stanzas like:

sslmode: verify-full # , if don't want use ~/.postgresq/root.crt cert location, set: sslrootcert: /path/to/my/app/root/cert.crt 

---

imo requirement pass single root cert libpq design flaw. should load trusted certificate database. similar issues exist use of ssl client certificates, can't supply keystore , cert store, must pass specific files given host. sounds that's ok since know upstream certificate signing authority.