Parameter · Connections and Authentication / SSL
ssl
Enables SSL connections.
- Default:
off - Type: bool
- Applies: Reload
In plain words
Turns on encrypted connections. With ssl = on and a certificate and key in place, clients can encrypt everything they send, including passwords and query results.
The server does not force encryption by itself: you do that with hostssl lines in pg_hba.conf, and clients with sslmode=require or stricter.
For DBAs and operators
On reload/start with ssl = on, the server loads ssl_cert_file and ssl_key_file (and optional CA/CRL files). Problems are reported at that point, e.g. FATAL: could not load server certificate file "server.crt": No such file or directory or FATAL: private key file "server.key" has group or world access (key must be mode 0600 owned by the server user, or 0640 owned by root). On reload a bad configuration only logs an error and keeps the old SSL context.
Client side: libpq's default sslmode=prefer tries TLS and silently falls back to plaintext; require encrypts but does not check the certificate; verify-full also checks the CA and host name and is the only mode that stops man-in-the-middle attacks. With ssl = off a require client gets server does not support SSL, but SSL was required. Since PostgreSQL 17, sslnegotiation=direct lets clients start TLS immediately (ALPN postgresql) without the SSLRequest round trip.
Check who is encrypted:
SELECT a.pid, a.usename, a.client_addr, s.version, s.cipher
FROM pg_stat_ssl s JOIN pg_stat_activity a USING (pid) WHERE s.ssl;How to change it
Change in postgresql.conf or ALTER SYSTEM, then run SELECT pg_reload_conf().
See it in context
Related parameters
ssl_cert_file ssl_key_file ssl_ca_file ssl_min_protocol_version listen_addresses