Connect TablePlus or DBeaver to Your Managed Postgres Over TLS
Managed PostgreSQL is only useful if you can actually query it — and that means connecting your GUI client securely over TLS. This guide walks you through connecting TablePlus and DBeaver to a CM Cloud managed Postgres instance with full TLS encryption in under five minutes.
If you don’t have a managed Postgres plan yet, see pricing at cmcloudhosting.com/pricing.
Why TLS Matters for a Remote Postgres Connection
Without TLS, your database credentials and query results travel in plain text across the internet. Any network observer — especially relevant on shared African ISP infrastructure — can read them.
TLS (Transport Layer Security) encrypts the entire connection tunnel, so credentials and data are protected end-to-end. CM Cloud managed Postgres enforces TLS by default; plain-text connections are rejected at the server level.
What You’ll Need Before You Start
- An active CM Cloud Managed PostgreSQL plan (from $9.99/mo / XAF 6,200 / €9.20)
- Your connection credentials from the CM Cloud portal: host, port, database name, username, password
- The CA certificate file (
ca.crt) — download it from the portal under Database > TLS Certificates - TablePlus (macOS/Windows/Linux) or DBeaver (cross-platform, free)
Save the ca.crt file somewhere you’ll remember — you’ll reference it in both clients.
Connect TablePlus to Managed Postgres Over TLS
Step 1 — Create a New Connection
Open TablePlus and press ⌘N (macOS) or Ctrl+N (Windows/Linux). Select PostgreSQL from the driver list.
Step 2 — Fill In the Basic Fields
| Field | Value |
|---|---|
| Name | CM Cloud Postgres (or any label) |
| Host | Your host from the portal (e.g. pg.cmcloudhosting.com) |
| Port | 5432 |
| Database | Your database name |
| User | Your database username |
| Password | Your database password |
Step 3 — Enable TLS / SSL
- Click the SSL tab at the top of the connection dialog.
- Toggle SSL Mode to
Verify Full— this validates the server certificate against your CA file, preventing man-in-the-middle attacks. - In CA Cert, browse to the
ca.crtfile you downloaded from the portal. - Leave Client Cert and Client Key blank unless CM Cloud support has issued you a client certificate (not required by default).
Step 4 — Test and Save
Click Test at the bottom of the dialog. You should see a green “Connection is OK” banner. Click Connect to open the connection, then Save to store it for future sessions.
If the test fails, double-check that your IP address is whitelisted in the CM Cloud portal under Database > Allowed IPs.
Connect DBeaver to Managed Postgres Over TLS
Step 1 — Create a New Connection
In DBeaver, go to Database > New Database Connection, search for PostgreSQL, and click Next.
Step 2 — Main Connection Tab
| Field | Value |
|---|---|
| Host | Your host from the CM Cloud portal |
| Port | 5432 |
| Database | Your database name |
| Username | Your database username |
| Password | Your database password |
Check Save password locally if you don’t want to re-enter it every session.
Step 3 — SSL Tab
- Click the SSL tab in the connection wizard.
- Tick Use SSL.
- Set SSL Mode to
verify-full. - In CA Certificate, browse to your downloaded
ca.crt. - Leave Client Certificate and Client Private Key empty.
Step 4 — Test Connection
Click Test Connection. DBeaver will attempt to download the Postgres JDBC driver on first use — allow it. A “Connected” dialog confirms success. Click Finish to save.
Troubleshooting Common TLS Connection Errors
“SSL connection has been closed unexpectedly”
This usually means the server rejected the SSL mode. Confirm your SSL mode is exactly verify-full (not disable or allow). CM Cloud’s Postgres rejects non-TLS connections.
“FATAL: no pg_hba.conf entry for host”
Your client IP is not whitelisted. Go to CM Cloud Portal > Managed Database > Allowed IPs and add your current public IP address. If you’re on a dynamic IP (common with MTN or Orange Cameroon mobile connections), you can temporarily allow your /24 subnet or use a static exit IP via a VPN.
“SSL certificate verify failed”
The ca.crt path is wrong or the file was corrupted during download. Re-download it from the portal and point your client to the fresh copy.
Connection Timeout
Check that port 5432 is not blocked by your local firewall or ISP. Some corporate networks in Cameroon block non-standard ports — if so, ask CM Cloud support about an alternative port.
CM Cloud Managed Postgres vs Alternatives
| Provider | Starter Price (USD) | XAF | EUR | Key Feature |
|---|---|---|---|---|
| CM Cloud | $9.99/mo | XAF 6,200 | €9.20 | TLS enforced, Africa-ready, XAF billing |
| Supabase | $25/mo | ~XAF 15,600 | ~€23 | Hosted Postgres + auth layer |
| Railway | $5 base + usage | ~XAF 3,100+ | ~€4.60+ | Usage-based, no fixed cost |
| DigitalOcean Managed PG | $15/mo | ~XAF 9,350 | ~€13.90 | Good reliability, USD only |
CM Cloud is the only provider in this table that bills in XAF, making it practical for Cameroonian businesses to pay without currency conversion fees. See the full plan breakdown at cmcloudhosting.com/pricing.
Keeping Your Connection Secure Long-Term
- Rotate passwords quarterly from the CM Cloud portal. DBeaver and TablePlus both let you update the stored password in the connection editor without recreating the whole connection.
- Restrict allowed IPs to only the machines that need database access — your dev laptop, your CI server, your app server. Never use
0.0.0.0/0in production. - Use a read-only user for analytics queries so a compromised BI tool can’t delete data. Create additional users in the portal under Database > Users.
- Never store credentials in a git repo. Use environment variables in your application and a secrets manager in CI. See our article on App Hosting environment variables for how CM Cloud handles this on the app side.
Frequently Asked Questions
Does CM Cloud Managed Postgres support psql CLI connections over TLS?
Yes. Use psql "host=YOUR_HOST port=5432 dbname=YOUR_DB user=YOUR_USER sslmode=verify-full sslrootcert=/path/to/ca.crt". The same CA certificate applies.
Is the CA certificate the same for all CM Cloud databases?
Yes — the CM Cloud root CA signs all managed database server certificates, so one ca.crt file covers all your databases on the platform.
Can I connect from a Node.js or Python app using the same TLS settings?
Absolutely. Pass ssl: { ca: fs.readFileSync('ca.crt') } in the pg Node driver, or set sslrootcert=ca.crt&sslmode=verify-full in your Python psycopg2 connection string.
What if I use App Hosting on CM Cloud for my backend?
If your backend runs on CM Cloud App Hosting, store the CA cert content as an environment variable (base64-encoded), decode it at runtime, and pass it to your database driver. No file system access needed.
Get Started
CM Cloud Managed PostgreSQL starts at $9.99/mo (XAF 6,200 / €9.20) with TLS enforced by default, African-friendly billing, and no renewal price hikes.
Visit cmcloudhosting.com/pricing to activate your database, download your CA certificate, and connect TablePlus or DBeaver in minutes.