Take the 2-minute tour ×
Database Administrators Stack Exchange is a question and answer site for database professionals who wish to improve their database skills and learn from others in the community. It's 100% free, no registration required.

I have configured ssl = on in postgresql.conf (and installed a certificate etcetera). Does this ensure that all clients will always connect over SSL?

(I.e. does ssl = on it make it impossible to connect without SSL encryption?)

Are there other ways to ensure that all clients always connect over SSL/TLS?

Kind regards, KajMagnus

share|improve this question
add comment

2 Answers

up vote 6 down vote accepted

ssl = on only enables the possibility of using SSL.

To ensure that all clients are using SSL, add hostssl lines in pg_hba.conf, e.g.,

hostssl  all  all  0.0.0.0/0  md5

and remove all host lines. (Well, maybe keep the ones for localhost.)

share|improve this answer
add comment

No, that simply enables the use of SSL. You need to also make the appropriate changes to your pg_hga.conf file.

share|improve this answer
    
Oh, I must have misread the docs: I thought hostssl required the client to provide its own SSL certificate, but now I noticed that there's a cert authentication method that I can specify in pg_hga.conf. –  KajMagnus Dec 1 '11 at 1:18
    
(Thank you, I'll upvote your answer later when I have the required 15 rep.) –  KajMagnus Dec 1 '11 at 1:19
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.