How to fix No SSL connection in PostgreSQL

PostgreSQLINTERMEDIATEHIGH

The 'No SSL connection' error occurs when a PostgreSQL client expects an SSL/TLS encrypted connection but the server either doesn't support SSL, hasn't enabled it, or the connection parameters don't match. This commonly appears when sslmode is set to require or verify-ca but SSL isn't properly configured.

What this error means

This error indicates a mismatch between what the client expects and what the PostgreSQL server provides regarding SSL/TLS encryption. The client may have been configured to require SSL connections (via the sslmode parameter), but the server is either not listening with SSL enabled, doesn't have SSL certificates configured, or the client and server have incompatible SSL settings. The server might also be configured to allow only non-SSL connections to the client's IP address in pg_hba.conf.

How to fix "No SSL connection"

1Verify PostgreSQL server has SSL support enabled

Connect to the PostgreSQL server (locally if possible) and check SSL status:

bash

psql -U postgres

Inside psql, run:

sql

SHOW ssl;

If the output is off, SSL is disabled. Check the server's configuration:

bash

sudo grep -n "^ssl = " /etc/postgresql/15/main/postgresql.conf

If SSL is disabled, enable it by editing the config:

bash

sudo nano /etc/postgresql/15/main/postgresql.conf

Find or add the line:

bash

ssl = on

Also verify certificate files exist:

bash

ls -la /etc/postgresql/15/main/server.crt
ls -la /etc/postgresql/15/main/server.key

If certificates don't exist, you need to generate them (see Advanced Notes).

2Update your connection string's sslmode parameter

PostgreSQL uses the sslmode parameter to control SSL behavior. Adjust based on your needs:

bash

# Development (no SSL verification - less secure)
postgresql://user:password@localhost:5432/dbname?sslmode=disable

# Production (SSL required, certificate verified against root CA)
postgresql://user:password@hostname:5432/dbname?sslmode=require

# SSL required with full verification (recommended for production)
postgresql://user:password@hostname:5432/dbname?sslmode=verify-full&sslrootcert=/path/to/root.crt

# SSL preferred but not required (fallback to non-SSL if SSL fails)
postgresql://user:password@hostname:5432/dbname?sslmode=prefer

For Node.js/pg driver:

javascript

const client = new Client({
  user: 'postgres',
  password: 'password',
  host: 'hostname',
  port: 5432,
  database: 'dbname',
  ssl: {
    rejectUnauthorized: false  // For self-signed certs (dev only)
  }
});

For Java/JDBC:

bash

jdbc:postgresql://hostname:5432/dbname?sslmode=require&ssl=true

3Configure pg_hba.conf to accept SSL connections

The pg_hba.conf file controls which connections require SSL. Edit it:

bash

sudo nano /etc/postgresql/15/main/pg_hba.conf

Replace or add host lines with hostssl to require SSL:

bash

# Before (allows non-SSL):
host    all             all             192.168.1.0/24          md5

# After (requires SSL):
hostssl all             all             192.168.1.0/24          md5

For AWS RDS PostgreSQL (uses IAM auth or username/password):
- RDS enforces SSL by default for most instance types
- Add sslmode=require to your connection string

After updating pg_hba.conf, reload the server:

bash

sudo systemctl reload postgresql

Verify the changes:

bash

sudo -u postgres psql -c "SHOW ssl;"

4Ensure server certificate has correct hostname

When using sslmode=verify-full, the certificate's Common Name (CN) or Subject Alternative Name (SAN) must match the hostname in your connection string.

Check the server certificate:

bash

sudo openssl x509 -in /etc/postgresql/15/main/server.crt -text -noout

Look for:

bash

Subject: CN = hostname.example.com

Or for SAN (Subject Alternative Name):

bash

X509v3 Subject Alternative Name:
    DNS:hostname.example.com, DNS:*.example.com

If the hostname doesn't match:

Option 1: Use hostname from certificate
Update your connection string to use the hostname from the certificate:

bash

postgresql://user:[email protected]:5432/dbname?sslmode=verify-full

Option 2: Generate new certificate with correct hostname
Remove old certificate and regenerate:

bash

sudo rm /etc/postgresql/15/main/server.crt /etc/postgresql/15/main/server.key
sudo -u postgres openssl req -new -x509 -days 365 -nodes \
  -out /etc/postgresql/15/main/server.crt \
  -keyout /etc/postgresql/15/main/server.key \
  -subj "/CN=hostname.example.com"
sudo chmod 600 /etc/postgresql/15/main/server.key
sudo chown postgres:postgres /etc/postgresql/15/main/server.crt
sudo chown postgres:postgres /etc/postgresql/15/main/server.key
sudo systemctl restart postgresql

5Obtain and configure root certificate for verification

When using sslmode=verify-ca or verify-full, you need the root CA certificate that signed the server certificate.

For cloud providers:

AWS RDS:

bash

# Download RDS CA certificate
wget https://truststore.amazonaws.com/global/certificates/rds-ca-2019-root.pem

# Use in connection string
postgresql://user:password@hostname:5432/dbname?sslmode=require&sslrootcert=/path/to/rds-ca-2019-root.pem

Azure Database for PostgreSQL:

bash

# Download Azure CA certificate
wget https://cacerts.digicert.com/DigiCertGlobalRootCA.crt

# Use in connection
postgresql://user:[email protected]:5432/dbname?sslmode=require&sslrootcert=/path/to/DigiCertGlobalRootCA.crt

For self-signed certificates:

bash

# Extract the CA certificate from the server certificate
sudo openssl x509 -in /etc/postgresql/15/main/server.crt -out ca.crt

# Copy to client machine at ~/.postgresql/root.crt
mkdir -p ~/.postgresql
cp ca.crt ~/.postgresql/root.crt
chmod 600 ~/.postgresql/root.crt

Then use in connection:

bash

postgresql://user:password@hostname:5432/dbname?sslmode=verify-ca&sslrootcert=/home/user/.postgresql/root.crt

6Test SSL connection with psql

Verify SSL works with the psql command-line client:

bash

# Test with SSL required (will fail if server doesn't support SSL)
psql -h hostname -U postgres -d postgres --set=sslmode=require

# Test with full verification (requires matching hostname)
psql -h hostname -U postgres -d postgres \
  --set=sslmode=verify-full \
  --set=sslrootcert=/path/to/root.crt

# See verbose SSL negotiation details
psql -h hostname -U postgres -d postgres \
  --set=sslmode=require \
  -v sslmode=require -d

If this succeeds, your server SSL is properly configured. If it fails, check PostgreSQL server logs:

bash

sudo journalctl -u postgresql -n 50 --no-pager
# or
sudo tail -50 /var/log/postgresql/postgresql-15-main.log

How to fix No SSL connection in PostgreSQL

What this error means

Typical symptoms

Common causes

How to fix "No SSL connection"

Advanced notes

Related errors

Official resources & further reading