"local" is for Unix domain socket connections only

local all all trust

IPv4 local connections:

host all all 127.0.0.1/32 trust

IPv4 remote connections for authenticated users

hostssl all webadmin 0.0.0.0/0 md5 clientcert=verify-full

![Image 10: setup SSL via pg_hba file](assets/knowledge-base/paas-reference/ssl-for-pgsql-09-setup-ssl-via-pghba-file-hu02572c9d050a8c3016d5d32eb157c0-b5fdd6ff1906.png)

**Notes:**

*   If you want to work with a database as a user other than the default _**webadmin**_, change the appropriate value within the last line of the config to the required name. In this case, you’ll need to use the same username for all the further commands (we’ll denote where this is required).
*   Also, for the older PostgreSQL versions (_10_ and lower), you need to change the _clientcert_ value to one “**md5 clientcert=1**” in the last line of the config:

`hostssl all         webadmin    0.0.0.0/0             md5 clientcert=1`

Save the updated file.

7. To finish configurations, you need to apply some more changes to the _**postgresql.conf**_ file.

Navigate to its _Security and Authentication_ section (approximately at the _80th_ line) and activate **SSL** usage itself, through uncommenting the same-named setting and changing its value to “_on_”. Also, add the new **ssl_ca_file** parameter below:

ssl = on ssl_ca_file = 'root.crt'

![Image 11: enable SSL on PostgreSQL server](assets/knowledge-base/paas-reference/ssl-for-pgsql-10-enable-ssl-on-postgresql-server-hu2fe9df89a76602c103daaf6-433f1f0f88be.png)
Don’t forget to save these changes.

8. Lastly, restart your PostgreSQL container in order to apply new settings:

bash

`sudo service postgresql restart`

![Image 12: restart PostgreSQL server](assets/knowledge-base/paas-reference/ssl-for-pgsql-11-restart-postgresql-server-hue949414ee24439c01846ad00c8dff-6047775473db.png)
## Client Certificates

Now, let’s create one more set of SSL certificate files for client instance, in order to support secure connection on both sides.

1. Return to the terminal window with SSH connection to your PostgreSQL server you’ve operated through during [server setup](paas-guide-ssl-for-pgsql.html#postgresql-server-configuration) (or reconnect to it) - you’ll need your server certificates for further actions.

Once inside, generate a private key for client (also without a _pass phrase_, just as it was done in the previous section), for example within the **tmp** directory:

bash

openssl genrsa -des3 -out /tmp/postgresql.key 1024 openssl rsa -in /tmp/postgresql.key -out /tmp/postgresql.key

![Image 14: generate SSL key and remove pass phrase](assets/knowledge-base/paas-reference/ssl-for-pgsql-12-generate-ssl-key-and-remove-pass-phrase-hu7349e2a6f1a047f-763cc92c3441.png)
2. Next, create SSL certificate for your PostgreSQL database user (_webadmin_ by default) and sign it with our trusted _**root.crt**_ file on server.

bash

openssl req -new -key /tmp/postgresql.key -out /tmp/postgresql.csr -subj '/C=US/ST=California/L=PaloAlto/O=Ruk-Com PaaS/CN=webadmin' openssl x509 -req -in /tmp/postgresql.csr -CA root.crt -CAkey server.key -out /tmp/postgresql.crt -CAcreateserial ```

Notes:

• while commonly data for the subj parameter can be changed to your personal data here, its Common Name (/CN=) must be equal to database user name you’ve set during the first certificate generation in server configuration file (webadmin in our case)
• root.crt and server.key files should be located in the same folder the 2nd command is executed from; otherwise, the full path to them should be specified

3. After the files - postgresql.key, postgresql.crt, root.crt - are ready, you need to move them to to the .postgresql folder at your client machine (for that, you can use FTP add-on or just copy and paste files content).

Tip: If such directory does not exist yet, create it with mkdir ~/.postgresql or similar command according to your OS distribution.

Also, if needed, you can set the key read permission for owner only with the chmod 0400 ~/.postgresql/postgresql.key command to achieve more security.

Tip: Don’t forget to remove keys from the tmp directory on your DB server afterwards.

Establish Connection via PgAdmin

Eventually, after server and client configurations are done, you are ready to establish the connection. In our case, we’ll use the pgAdmin 3 tool as an example, so get this application (or any other preferred one) installed beforehand.

1. In order to connect to the DB server via SSL, you need either public IP or endpoint being attached for your PostgreSQL database container.

We’ll consider the latter case - access environment Settings, switch to the Endpoints section and Add new endpoint with the same-named button at the top pane.

2. Now, when you have an access point, run your pgAdmin 3 client and select the New Server Registration option.

In the Properties tab of the opened window, specify the following data:

• Name - any desired connection name (e.g., ssl-to-pgsql)
• Host - access point you’ve added in the first step (Public IP address or endpoint Access URL without port number)
• Port - use the default port 5432 for External IP or endpoint’s Public port (denoted in the same-named section of the appropriate column)
• Username - database user you’ve set the SSL certificate and configurations for (i.e., webadmin by default)
• Password - the corresponding user’s password (sent via email for webadmin or the one you’ve set otherwise)

The rest of the fields can be left unchanged or adjusted according your requirements.

3. Next, switch to the SSL tab and, for the same-named line, select the require option from the drop-down list.

That’s all! The required certificates will be loaded automatically during the first connection establishment, so just click OK to start managing your database via secure connection.

Now you can connect your application to database (use the Connect to Database guide as an example) and enable SSL configurations for your project to encrypt your data while fetching/transferring.