43

I have configured ssl = on in postgresql.conf (and installed a certificate etcetera). Does this ensure that all clients will always connect over SSL?

(I.e. does ssl = on it make it impossible to connect without SSL encryption?)

Are there other ways to ensure that all clients always connect over SSL/TLS?

3 Answers 3

41

ssl = on only enables the possibility of using SSL.

To ensure that all clients are using SSL, add hostssl lines in pg_hba.conf, e.g.,

hostssl  all  all  0.0.0.0/0  md5

and remove all host lines. (Well, maybe keep the ones for localhost.)

If the desire is to force the client to send a certificate, then md5 has to be changed to cert. e.g.,

hostssl  all  all  0.0.0.0/0  cert
0
15

No, that simply enables the use of SSL. You need to also make the appropriate changes to your pg_hga.conf file.

0
0

Just FYI, Try to avoid making connections without passwords. One of the strongest choices would be ssl (verify-full mode) + password authentication (encrypted with scram-sha-256).

Your pg_hba.conf could be like:

hostssl  all  all  0.0.0.0/0  scram-sha-256 clientcert=verify-full

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.