Database Administrators Stack Exchange is a question and answer site for database professionals who wish to improve their database skills and learn from others in the community. It only takes a minute to sign up.
Sign up to join this community
I have configured ssl = on in postgresql.conf (and installed a certificate etcetera). Does this ensure that all clients will always connect over SSL?
(I.e. does ssl = on it make it impossible to connect without SSL encryption?)
Are there other ways to ensure that all clients always connect over SSL/TLS?
Kind regards, KajMagnus
ssl = on only enables the possibility of using SSL.
To ensure that all clients are using SSL, add hostssl lines in pg_hba.conf, e.g.,
hostssl all all 0.0.0.0/0 md5
and remove all host lines. (Well, maybe keep the ones for localhost.)
postgresql.conf and pg_hba.conf. However I can still connect with sslmode=disable. e.g. psql "sslmode=disable host=localhost dbname=test" Did I miss anything here?
– Andy Aldo
May 24 '18 at 4:42
No, that simply enables the use of SSL. You need to also make the appropriate changes to your pg_hga.conf file.
hostssl required the client to provide its own SSL certificate, but now I noticed that there's a cert authentication method that I can specify in pg_hga.conf.
– KajMagnus
Dec 1 '11 at 1:18
