Postgres Require SSL Hosting: Why Your Database Must Refuse Plaintext Connections

By /

Postgres Require SSL Hosting: Why Your Database Must Refuse Plaintext Connections

Plaintext database connections are a security hole that no production system should tolerate — yet many developers leave the default sslmode=disable in place and never think about it again. This article explains exactly why managed PostgreSQL must enforce SSL, how to verify your connection is encrypted, and what to look for in a hosting provider.

What “Require SSL” Actually Means in PostgreSQL

PostgreSQL supports several sslmode values: disable, allow, prefer, require, verify-ca, and verify-full. The default in many drivers is prefer — meaning the client asks for TLS but silently falls back to plaintext if the server does not offer it.

sslmode=require flips the responsibility: the client refuses to connect unless the server presents a valid TLS certificate. There is no silent fallback.

sslmode=verify-full goes further — it also validates that the certificate’s Common Name matches the hostname you connected to, defeating man-in-the-middle attacks even on networks you don’t fully control.

Why Plaintext Connections Are Dangerous

Credentials Travel in the Clear

A PostgreSQL handshake sends your username and password before any query runs. Without TLS, anyone on the same network segment — a shared cloud hypervisor, a coffee-shop router, an AWS availability zone — can read them with a packet sniffer in seconds.

Query Results Are Equally Exposed

Every SELECT response, every INSERT value, every row of customer data flows through that same unencrypted channel. A single intercepted query can expose an entire table of PII.

Compliance Makes It Non-Negotiable

GDPR (Article 32), PCI-DSS (Requirement 4.2), and most African data protection frameworks — including Cameroon’s Law No. 2010/012 — require encryption in transit for personal data. “We didn’t configure SSL” is not a defence auditors accept.

How a Managed Host Should Enforce SSL

A properly configured managed PostgreSQL host does three things:

  1. Sets ssl = on in postgresql.conf — the server will offer TLS on every connection.
  2. Sets hostssl rules in pg_hba.conf and removes plain host rules — the server refuses non-TLS connections at the authentication layer, not just discourages them.
  3. Provisions a CA-signed certificate — so clients using sslmode=verify-full can actually validate the server identity.

When all three are in place, a connection string like:

postgresql://user:[email protected]:5432/mydb?sslmode=disable

…returns an error immediately. That error is the correct behaviour.

Verifying Your Connection Is Encrypted

Once connected, run:

SELECT ssl, version, cipher, bits
FROM pg_stat_ssl
WHERE pid = pg_backend_pid();

A secure connection returns ssl = true and shows the cipher negotiated (e.g., TLS_AES_256_GCM_SHA384). If ssl = false, your connection is plaintext — fix it before going to production.

For GUI tools, see the companion article Connect TablePlus or DBeaver to Your Managed Postgres Over TLS on this blog for step-by-step screenshots.

Connection String Examples by Language

Node.js (node-postgres)

const { Pool } = require('pg');
const pool = new Pool({
  connectionString: process.env.DATABASE_URL,
  ssl: { rejectUnauthorized: true }   // verify-full equivalent
});

Python (psycopg2)

import psycopg2
conn = psycopg2.connect(
    dsn=os.environ['DATABASE_URL'],
    sslmode='verify-full'
)

Laravel (.env)

DB_CONNECTION=pgsql
DB_HOST=your-db-host
DB_PORT=5432
DB_SSLMODE=require

In all cases, never hardcode credentials — use environment variables. CM Cloud App Hosting lets you set these in the portal dashboard; see App Hosting Environment Variables: Deploy Secrets Safely on CM Cloud for the full workflow.

What to Look for in a Postgres Hosting Provider

Not every provider enforces SSL at the server level. Some enable TLS but still allow plaintext fallback. Ask these questions before committing:

  • Does the server reject sslmode=disable connections outright?
  • Is a CA-signed certificate provided (not self-signed)?
  • Is TLS termination done at the database layer, not just a proxy?
  • Are connection strings provided with the correct sslmode pre-filled?

CM Cloud Managed PostgreSQL enforces TLS on every connection, provides CA-signed certificates, and rejects plaintext at the pg_hba.conf layer. Pricing starts at $9.99/mo (XAF 6,500 / €9.25) — see full plan details at cmcloudhosting.com/pricing.

Provider Comparison: Managed PostgreSQL SSL Enforcement

Provider Starter Price (USD) XAF EUR SSL Enforcement
CM Cloud $9.99/mo XAF 6,500 €9.25 Server-level hostssl — plaintext refused
DigitalOcean Managed PG $15.00/mo ~XAF 9,200 ~€13.90 TLS required, CA cert provided
Railway (Postgres) ~$10–20/mo (usage) ~XAF 6,000–12,000 ~€9–18 TLS available; sslmode=prefer default
Supabase (free tier) $0 → $25/mo ~XAF 0–15,000 €0–23 TLS on; free tier has connection limits

CM Cloud prices shown in all three currencies. Competitor prices in USD only — XAF/EUR are approximate conversions, not published local prices.

Common Mistakes That Bypass SSL Even When Enabled

Mistake 1 — Leaving sslmode=prefer in Production

prefer silently downgrades if the server misconfiguration drops TLS. Use require or verify-full — never prefer — in any environment that touches real data.

Mistake 2 — Trusting Internal Networks Unconditionally

“Our database is on a private VPC so we don’t need SSL.” VPC-internal traffic is not automatically encrypted. A compromised instance inside the same VPC can sniff unencrypted database traffic.

Mistake 3 — Ignoring Certificate Expiry

A managed host should rotate certificates automatically. If yours does not, set a calendar reminder — an expired cert causes verify-full connections to fail hard, which is correct behaviour, but still causes an outage if you’re not prepared.

Mistake 4 — Using Different Settings Per Environment

If your staging database uses sslmode=disable and production uses require, a connection string copied from staging to production (or vice versa) creates a silent security regression. Standardise sslmode=require across all environments.

SSL Is Not Enough on Its Own

TLS encrypts the channel — it does not control who can connect. Combine SSL enforcement with:

  • IP allowlisting: only your app server’s IP (or VPC CIDR) can reach the database port.
  • Strong passwords: rotated regularly, never shared across services.
  • Least-privilege roles: your application user should not have SUPERUSER or CREATEDB.
  • Audit logging: log_connections = on and log_disconnections = on in postgresql.conf so you know who connected and when.

CM Cloud Managed PostgreSQL includes IP allowlisting in the dashboard and generates least-privilege credentials by default.

CM Cloud Managed PostgreSQL Plans

Plan USD XAF EUR
Starter $9.99/mo XAF 6,500 €9.25

Full plan details and add-ons are at cmcloudhosting.com/pricing.

Start With a Database That Refuses Plaintext

Enforcing postgres require ssl is not optional in 2026 — regulators, auditors, and your users expect it. The right managed host does it for you at the server layer so there is no config you can accidentally omit.

CM Cloud Managed PostgreSQL starts at $9.99/mo (XAF 6,500 / €9.25), enforces TLS on every connection, and is built for businesses in Cameroon, West Africa, and across the globe.

Get started at cmcloudhosting.com and deploy a database that refuses to let plaintext through — by design.

Scroll to Top