In this lesson, you will learn how to harden your PostgreSQL infrastructure by enforcing encrypted data transit and requiring cryptographic certificates for client identity verification.
While role-based access control manages what a user can do, SSL/TLS ensures who the user is and keeps their communication private. When you enable SSL in PostgreSQL, you prevent "man-in-the-middle" attacks where data could be intercepted or tampered with as it travels over the network.
Enforcing Encryption
To mandate SSL for all connections, you configure the server to prioritize secure channels. In your postgresql.conf, you set ssl = on. To go a step further, you can enforce this at the connection level by modifying your pg_hba.conf file:
# Allow only SSL-encrypted connections for all users from a specific network
hostssl all all 192.168.1.0/24 md5
Using hostssl instead of host ensures that the server rejects any non-encrypted connection attempt, effectively preventing accidental cleartext transmission.
Certificate-Based Authentication
Beyond simple encryption, you can transition from password-based logins to certificate-based authentication. This requires the client to present a trusted SSL certificate to the server, verifying their identity without transmitting a password at all.
You configure this in pg_hba.conf by specifying the cert authentication method:
# Require a valid client certificate for this host
hostssl all all 192.168.1.0/24 cert clientcert=verify-full
When clientcert=verify-full is enabled, PostgreSQL checks that the provided certificate is signed by a trusted Certificate Authority (CA) and that the common name (CN) in the certificate matches the requested database user. This creates a powerful, high-security handshake where the database trusts the client based on a cryptographically signed identity rather than a shared secret like a password.
By combining hostssl with cert authentication, you move your database security from relying on "things you know" (passwords) to "things you possess" (private keys), significantly reducing the risk of credential theft.
Key Takeaway: Enforcing SSL via hostssl ensures data privacy, while switching to cert authentication replaces vulnerable passwords with robust, cryptographic identity verification.