Database Administrators Stack Exchange is a question and answer site for database professionals who wish to improve their database skills and learn from others in the community. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have configured ssl = on in postgresql.conf (and installed a certificate etcetera). Does this ensure that all clients will always connect over SSL?

(I.e. does ssl = on it make it impossible to connect without SSL encryption?)

Are there other ways to ensure that all clients always connect over SSL/TLS?

Kind regards, KajMagnus

share|improve this question
up vote 8 down vote accepted

ssl = on only enables the possibility of using SSL.

To ensure that all clients are using SSL, add hostssl lines in pg_hba.conf, e.g.,

hostssl  all  all  md5

and remove all host lines. (Well, maybe keep the ones for localhost.)

share|improve this answer

No, that simply enables the use of SSL. You need to also make the appropriate changes to your pg_hga.conf file.

share|improve this answer
Oh, I must have misread the docs: I thought hostssl required the client to provide its own SSL certificate, but now I noticed that there's a cert authentication method that I can specify in pg_hga.conf. – KajMagnus Dec 1 '11 at 1:18
(Thank you, I'll upvote your answer later when I have the required 15 rep.) – KajMagnus Dec 1 '11 at 1:19

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.