24

I have configured ssl = on in postgresql.conf (and installed a certificate etcetera). Does this ensure that all clients will always connect over SSL?

(I.e. does ssl = on it make it impossible to connect without SSL encryption?)

Are there other ways to ensure that all clients always connect over SSL/TLS?

Kind regards, KajMagnus

|improve this question
23

ssl = on only enables the possibility of using SSL.

To ensure that all clients are using SSL, add hostssl lines in pg_hba.conf, e.g.,

hostssl  all  all  0.0.0.0/0  md5

and remove all host lines. (Well, maybe keep the ones for localhost.)

|improve this answer
  • I have setup all the settings in postgresql.conf and pg_hba.conf. However I can still connect with sslmode=disable. e.g. psql "sslmode=disable host=localhost dbname=test" Did I miss anything here? – Andy Aldo May 24 '18 at 4:42
  • @AndyAldo One would need to see the whole configuration to analyze that. That's out of scope here. – Peter Eisentraut Jun 4 '18 at 13:49
13

No, that simply enables the use of SSL. You need to also make the appropriate changes to your pg_hga.conf file.

|improve this answer
  • 2
    Oh, I must have misread the docs: I thought hostssl required the client to provide its own SSL certificate, but now I noticed that there's a cert authentication method that I can specify in pg_hga.conf. – KajMagnus Dec 1 '11 at 1:18
  • (Thank you, I'll upvote your answer later when I have the required 15 rep.) – KajMagnus Dec 1 '11 at 1:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.