psql command, how to enforce certificate check?
To have psql verify the server certificate, you must specify the appropriate connection string options. This is done by the libpq client shared library, so it will work the same with all clients that use it.


You can directly specify the options in the connection string:

psql 'host=... port=... dbname=... user=... sslmode=verify-full sslrootcert=/path/to/ca-certificate sslcrl=/path/to/certificate-revocation-list'


If the CA certificate of the revocation list are in the default locations, you can omit the respective options.

See the documentation on sslrootcert and sslcrl.
You can use environment variables to specify the options:

export PGSSLMODE=verify-full
export PGSSLROOTCERT=/path/to/ca-certificate
export PGSSLCRL=/path/to/certificate-revocation-list
psql -h ... -p ... -d ... -U ...


See the documentation on environment variables for details.


For details on how server verification works, consult the appropriate section of the documentation.