Download Your PostgreSQL CA and Verify Pooler Hostnames

What's changed

• In a managed PostgreSQL database's Connectivity tab, Download the CA certificate (PEM) now gives you the CA the database presents right now, read live from the database, and a new Certificate authority card shows the current CA's expiry date and SHA-256 fingerprint; a database still on the older setup keeps the ZIP download
• The same certificate is available over the API: GET /api/v1/database/{id}/ca-certificate with a token that can read databases returns the PEM bundle, its expiry date and its SHA-256 fingerprint, and never a private key. A 503 means the CA could not be read for the moment, so try again; a database still on the older setup answers 404
• The Connection pooler's certificate now lists the pooler's own private service names on new databases, and on existing databases once their configuration is next applied, so sslmode=verify-full can verify the pooler at the private address its card shows
• The default CA is valid for about 90 days. It renews itself with the same key, but a PEM file you already installed does not update itself, so download the CA again and refresh it in your clients before its expiry date