Require TLS on Managed PostgreSQL and Choose Your TLS Floor
Refuse unencrypted connections to a PostgreSQL database with one switch, and decide whether older clients may still connect with TLS 1.2.
What's changed
- Turn on Require TLS in the database's Connectivity tab and connections without TLS are refused
- It applies within about a minute while the database keeps running; set sslmode=require on every client before you switch it on
- It is off by default, so nothing changes until you turn it on, and you can turn it off again at any time
- Managed PostgreSQL requires TLS 1.3 by default; set ssl_min_protocol_version to TLSv1.2 in the Parameters tab or a parameter group for clients that cannot negotiate TLS 1.3, such as Prisma on macOS and Windows
- The TLS floor applies with a configuration reload, without a restart