PostgreSQL SSL modes: require or verify-full?
Use sslmode=require when you need an encrypted PostgreSQL connection. Use verify-full when you also want to verify the certificate chain and hostname. For a remote database, set up that identity check when your provider and client support it.
What each setting means
- require: an encrypted connection, without an explicit hostname-verification guarantee.
- verify-ca: certificate-chain verification against trusted certificate authorities.
- verify-full: certificate-chain verification plus a hostname match.
PostgreSQL's SSL documentation includes libpq-specific behavior, including a backward-compatibility caveat for require when a root certificate is present. Set the verification mode you actually want rather than relying on that exception. Other drivers can have different defaults and certificate-loading rules.
Gather the settings together
Get the exact hostname, port and database name from your provider. Obtain its current CA certificate through the provider's official documentation or dashboard. In the client, select the verification mode and configure the root certificate location if required. Do not paste a certificate from an unknown troubleshooting post.
In plainDB, PostgreSQL SSL mode and a root certificate are configurable on Mac and Windows. Refer to the connection guide for the surrounding fields. Verify the resulting connection before saving it as your production default.
Diagnose the specific certificate failure
A hostname mismatch calls for checking the hostname and the certificate's permitted names. An untrusted issuer calls for checking the CA chain. An expired certificate calls for checking the provider's current certificate and your machine's clock. Changing every SSL field simultaneously makes the original cause harder to identify.
When tunneling, distinguish the local tunnel endpoint from the database's TLS identity. Consult the driver's tunnel and hostname-verification behavior; a connection to localhost is not automatically proof that the upstream database is authenticated.
Share a reproducible report safely
Record the client version, SSL mode, error text and whether the direct or pooled endpoint was used. Redact passwords, connection secrets and any private network details before posting publicly. A useful report reproduces the failure without publishing a working credential.
Continue reading
Diagnose connection errors · Configure a connection
For the desktop workflow, compare plainDB features on Mac and Windows or download the 14-day trial.