How to fix No SSL connection in PostgreSQL

PostgreSQLINTERMEDIATEHIGHUpdated Dec 29, 2025· 272 views

The 'No SSL connection' error occurs when a PostgreSQL client expects an SSL/TLS encrypted connection but the server either doesn't support SSL, hasn't enabled it, or the connection parameters don't match. This commonly appears when sslmode is set to require or verify-ca but SSL isn't properly configured.

Quick fix

Fixes No SSL connection

psql -U postgres
  1. Verify PostgreSQL server has SSL support enabled
  2. Update your connection string's sslmode parameter
  3. Configure pg_hba.conf to accept SSL connections
  4. Ensure server certificate has correct hostname
postgresql — error
psql -U postgres
No SSL connection

What this error means

This error indicates a mismatch between what the client expects and what the PostgreSQL server provides regarding SSL/TLS encryption. The client may have been configured to require SSL connections (via the sslmode parameter), but the server is either not listening with SSL enabled, doesn't have SSL certificates configured, or the client and server have incompatible SSL settings. The server might also be configured to allow only non-SSL connections to the client's IP address in pg_hba.conf.

Typical symptoms

  • Connection fails with 'No SSL connection' or 'SSL connection required'
  • Applications work locally but fail when connecting remotely via SSL
  • Error appears when sslmode is set to 'require' or 'verify-ca'
  • Certificate verification errors when hostname doesn't match certificate CN
  • Connections succeed with sslmode=disable but fail with sslmode=require
  • PostgreSQL 16+ enforces SSL by default, causing connections to fail without proper SSL configuration

Common causes

  1. PostgreSQL server doesn't have SSL support compiled in (rare with modern builds)
  2. SSL certificates are not installed or configured on the PostgreSQL server
  3. pg_hba.conf only has 'host' entries instead of 'hostssl' for the client's IP/user combination
  4. Server's listen_addresses or ssl configuration doesn't match client connection expectations
  5. Client sslmode parameter is set to require/verify-ca but server isn't listening with SSL enabled
  6. Server certificate is self-signed or untrusted, and client doesn't have root certificate
  7. Firewall or proxy intercepting SSL connections or stripping SSL encryption
  8. Hostname mismatch: certificate CN doesn't match the hostname used in connection string
  9. Client SSL libraries (OpenSSL) are outdated or incompatible with server version

How to fix "No SSL connection"

1Verify PostgreSQL server has SSL support enabled

Connect to the PostgreSQL server (locally if possible) and check SSL status:

bash
psql -U postgres

Inside psql, run:

sql
SHOW ssl;

If the output is off, SSL is disabled. Check the server's configuration:

bash
sudo grep -n "^ssl = " /etc/postgresql/15/main/postgresql.conf

If SSL is disabled, enable it by editing the config:

bash
sudo nano /etc/postgresql/15/main/postgresql.conf

Find or add the line:

bash
ssl = on

Also verify certificate files exist:

bash
ls -la /etc/postgresql/15/main/server.crt
ls -la /etc/postgresql/15/main/server.key

If certificates don't exist, you need to generate them (see Advanced Notes).

2Update your connection string's sslmode parameter

PostgreSQL uses the sslmode parameter to control SSL behavior. Adjust based on your needs:

bash
# Development (no SSL verification - less secure)
postgresql://user:password@localhost:5432/dbname?sslmode=disable

# Production (SSL required, certificate verified against root CA)
postgresql://user:password@hostname:5432/dbname?sslmode=require

# SSL required with full verification (recommended for production)
postgresql://user:password@hostname:5432/dbname?sslmode=verify-full&sslrootcert=/path/to/root.crt

# SSL preferred but not required (fallback to non-SSL if SSL fails)
postgresql://user:password@hostname:5432/dbname?sslmode=prefer

For Node.js/pg driver:

javascript
const client = new Client({
  user: 'postgres',
  password: 'password',
  host: 'hostname',
  port: 5432,
  database: 'dbname',
  ssl: {
    rejectUnauthorized: false  // For self-signed certs (dev only)
  }
});

For Java/JDBC:

bash
jdbc:postgresql://hostname:5432/dbname?sslmode=require&ssl=true
3Configure pg_hba.conf to accept SSL connections

The pg_hba.conf file controls which connections require SSL. Edit it:

bash
sudo nano /etc/postgresql/15/main/pg_hba.conf

Replace or add host lines with hostssl to require SSL:

bash
# Before (allows non-SSL):
host    all             all             192.168.1.0/24          md5

# After (requires SSL):
hostssl all             all             192.168.1.0/24          md5

For AWS RDS PostgreSQL (uses IAM auth or username/password):
- RDS enforces SSL by default for most instance types
- Add sslmode=require to your connection string

After updating pg_hba.conf, reload the server:

bash
sudo systemctl reload postgresql

Verify the changes:

bash
sudo -u postgres psql -c "SHOW ssl;"
4Ensure server certificate has correct hostname

When using sslmode=verify-full, the certificate's Common Name (CN) or Subject Alternative Name (SAN) must match the hostname in your connection string.

Check the server certificate:

bash
sudo openssl x509 -in /etc/postgresql/15/main/server.crt -text -noout

Look for:

bash
Subject: CN = hostname.example.com

Or for SAN (Subject Alternative Name):

bash
X509v3 Subject Alternative Name:
    DNS:hostname.example.com, DNS:*.example.com

If the hostname doesn't match:

Option 1: Use hostname from certificate
Update your connection string to use the hostname from the certificate:

bash
postgresql://user:password@hostname.example.com:5432/dbname?sslmode=verify-full

Option 2: Generate new certificate with correct hostname
Remove old certificate and regenerate:

bash
sudo rm /etc/postgresql/15/main/server.crt /etc/postgresql/15/main/server.key
sudo -u postgres openssl req -new -x509 -days 365 -nodes \
  -out /etc/postgresql/15/main/server.crt \
  -keyout /etc/postgresql/15/main/server.key \
  -subj "/CN=hostname.example.com"
sudo chmod 600 /etc/postgresql/15/main/server.key
sudo chown postgres:postgres /etc/postgresql/15/main/server.crt
sudo chown postgres:postgres /etc/postgresql/15/main/server.key
sudo systemctl restart postgresql
5Obtain and configure root certificate for verification

When using sslmode=verify-ca or verify-full, you need the root CA certificate that signed the server certificate.

For cloud providers:

AWS RDS:

bash
# Download RDS CA certificate
wget https://truststore.amazonaws.com/global/certificates/rds-ca-2019-root.pem

# Use in connection string
postgresql://user:password@hostname:5432/dbname?sslmode=require&sslrootcert=/path/to/rds-ca-2019-root.pem

Azure Database for PostgreSQL:

bash
# Download Azure CA certificate
wget https://cacerts.digicert.com/DigiCertGlobalRootCA.crt

# Use in connection
postgresql://user:password@server.postgres.database.azure.com:5432/dbname?sslmode=require&sslrootcert=/path/to/DigiCertGlobalRootCA.crt

For self-signed certificates:

bash
# Extract the CA certificate from the server certificate
sudo openssl x509 -in /etc/postgresql/15/main/server.crt -out ca.crt

# Copy to client machine at ~/.postgresql/root.crt
mkdir -p ~/.postgresql
cp ca.crt ~/.postgresql/root.crt
chmod 600 ~/.postgresql/root.crt

Then use in connection:

bash
postgresql://user:password@hostname:5432/dbname?sslmode=verify-ca&sslrootcert=/home/user/.postgresql/root.crt
6Test SSL connection with psql

Verify SSL works with the psql command-line client:

bash
# Test with SSL required (will fail if server doesn't support SSL)
psql -h hostname -U postgres -d postgres --set=sslmode=require

# Test with full verification (requires matching hostname)
psql -h hostname -U postgres -d postgres \
  --set=sslmode=verify-full \
  --set=sslrootcert=/path/to/root.crt

# See verbose SSL negotiation details
psql -h hostname -U postgres -d postgres \
  --set=sslmode=require \
  -v sslmode=require -d

If this succeeds, your server SSL is properly configured. If it fails, check PostgreSQL server logs:

bash
sudo journalctl -u postgresql -n 50 --no-pager
# or
sudo tail -50 /var/log/postgresql/postgresql-15-main.log

Advanced notes

SSL Modes Explained: PostgreSQL's sslmode parameter has six values:
- disable: No SSL (plaintext)
- allow: Non-SSL first, fallback to SSL if required
- prefer: SSL first, fallback to non-SSL (default in some versions)
- require: SSL mandatory, no hostname verification
- verify-ca: SSL + verify server certificate chain to root CA
- verify-full: SSL + verify certificate and hostname match

For production, use verify-full if possible.

PostgreSQL 16+ Default Behavior: Starting with PostgreSQL 16, the server defaults to preferring SSL connections. If you're upgrading from an older version and clients fail, they likely need SSL certificates or sslmode configuration.

Certificate Generation: If your server doesn't have certificates, generate them:

bash
sudo -u postgres openssl req -new -x509 -days 3650 -nodes \
  -out /etc/postgresql/15/main/server.crt \
  -keyout /etc/postgresql/15/main/server.key \
  -subj "/CN=localhost"
sudo chmod 600 /etc/postgresql/15/main/server.key
sudo systemctl restart postgresql

Debugging SSL Issues: Enable verbose logging in postgresql.conf:

bash
log_connections = on
log_disconnections = on
log_statement = 'all'

Then monitor logs for SSL-related errors.

Connection Poolers: If using PgBouncer or pgpool-II, ensure they also have SSL configured on both the client-facing side and backend connection to PostgreSQL.

Kubernetes/Docker: In containerized environments, ensure:
1. PostgreSQL pod/service has SSL certificates mounted
2. Client pods can access the CA certificate
3. DNS hostname resolves correctly for certificate verification

Frequently asked questions

What does "No SSL connection" mean?
This error indicates a mismatch between what the client expects and what the PostgreSQL server provides regarding SSL/TLS encryption. The client may have been configured to require SSL connections (via the sslmode parameter), but the server is either not listening with SSL enabled, doesn't have SSL certificates configured, or the client and server have incompatible SSL settings. conf.
How do I fix "No SSL connection"?
The 'No SSL connection' error occurs when a PostgreSQL client expects an SSL/TLS encrypted connection but the server either doesn't support SSL, hasn't enabled it, or the connection parameters don't match. This commonly appears when sslmode is set to require or verify-ca but SSL isn't properly configured.
What causes "No SSL connection"?
PostgreSQL server doesn't have SSL support compiled in (rare with modern builds) SSL certificates are not installed or configured on the PostgreSQL server pg_hba.conf only has 'host' entries instead of 'hostssl' for the client's IP/user combination
Is the "No SSL connection" error serious?
Yes. This is a high-severity error that usually blocks work until it is fixed, but the steps above resolve it.

Official resources & further reading