{"id":8830,"date":"2016-09-09T18:30:33","date_gmt":"2016-09-09T16:30:33","guid":{"rendered":"https:\/\/www.dbi-services.com\/blog\/securing-your-connections-to-postgresql-by-using-ssl\/"},"modified":"2016-09-09T18:30:33","modified_gmt":"2016-09-09T16:30:33","slug":"securing-your-connections-to-postgresql-by-using-ssl","status":"publish","type":"post","link":"https:\/\/www.dbi-services.com\/blog\/securing-your-connections-to-postgresql-by-using-ssl\/","title":{"rendered":"Securing your connections to PostgreSQL by using SSL"},"content":{"rendered":"

Security is a big topic today and in the news almost every day. As the database usually holds sensitive data this data must be well protected. In most cases this is done by encrypting critical data inside the database and decrypt only when requested. But this is not all: When a client reads the data it is decrypted inside the database and then send back over the network unencrypted. What do you win with such a setup? The only risk it protects you from is a theft of either your disks or the whole server. Even more important is that all the connections to your database are encrypted so the traffic from and to your database can not be read be someone else. In this post we’ll look at how you can do this with PostgreSQL.<\/p>\n

<\/p>\n

Obviously, for securing the connections to the database by using SSL we’ll need a server certificate. As I am on Linux this can be generated very easy by using openssl<\/a> to create a self signed certificate. Be aware that your PostgreSQL binaries need to be compiled with “–with-openssl” for the following to work. You can check this by using using pg_config<\/a>:<\/p>\n

\npostgres@pgbox:\/u01\/app\/postgres\/local\/dmk\/ [PG960] pg_config | grep CONFIGURE\nCONFIGURE = '--prefix=\/u01\/app\/postgres\/product\/96\/db_0' '--exec-prefix=\/u01\/app\/postgres\/product\/96\/db_0' '--bindir=\/u01\/app\/postgres\/product\/96\/db_0\/bin' '--libdir=\/u01\/app\/postgres\/product\/96\/db_0\/lib' '--sysconfdir=\/u01\/app\/postgres\/product\/96\/db_0\/etc' '--includedir=\/u01\/app\/postgres\/product\/96\/db_0\/include' '--datarootdir=\/u01\/app\/postgres\/product\/96\/db_0\/share' '--datadir=\/u01\/app\/postgres\/product\/96\/db_0\/share' '--with-pgport=5432' '--with-perl' '--with-python' '--with-tcl' '--with-openssl' '--with-pam' '--with-ldap' '--with-libxml' '--with-libxslt' '--with-segsize=2' '--with-blocksize=8' '--with-wal-segsize=16' '--with-extra-version= dbi services build'\n<\/pre>\n
To create a self signed certificate with openssl simple execute the following command:<\/p>\n
\npostgres@pgbox:\/home\/postgres\/ [PG960] openssl req -new -text -out server.req\n<\/pre>\n
This creates a new certificate request<\/a> based on the information you provide. The only important point here (for the scope of this post) is that the “Common Name” must match the server name where your PostgreSQL is running on, e.g.:<\/p>\n
\nGenerating a 2048 bit RSA private key\n............................................................................................................................................+++\n..................................................................................................+++\nwriting new private key to 'privkey.pem'\nEnter PEM pass phrase:\nVerifying - Enter PEM pass phrase:\n-----\nYou are about to be asked to enter information that will be incorporated\ninto your certificate request.\nWhat you are about to enter is what is called a Distinguished Name or a DN.\nThere are quite a few fields but you can leave some blank\nFor some fields there will be a default value,\nIf you enter '.', the field will be left blank.\n-----\nCountry Name (2 letter code) [XX]:CH\nState or Province Name (full name) []:BS\nLocality Name (eg, city) [Default City]:Basel\nOrganization Name (eg, company) [Default Company Ltd]:dbi services\nOrganizational Unit Name (eg, section) []:dba\nCommon Name (eg, your name or your server's hostname) []:pgbox\nEmail Address []:xx@xx@com\n\nPlease enter the following 'extra' attributes\nto be sent with your certificate request\nA challenge password []:\nAn optional company name []:\n<\/pre>\n
This created two files in the directory where you executed the command (the first one is the certificate request and the second one is the private key):<\/p>\n
\n-rw-r--r--. 1 postgres postgres  3519 Sep  9 13:24 server.req\n-rw-r--r--. 1 postgres postgres  1821 Sep  9 13:24 privkey.pem\n<\/pre>\n
If you want your PostgreSQL instance to start automatically you should remove the pass phrase from the generated private key:<\/p>\n
\npostgres@pgbox:\/home\/postgres\/ [PG960] openssl rsa -in privkey.pem -out server.key\nEnter pass phrase for privkey.pem:\nwriting RSA key\npostgres@pgbox:\/home\/postgres\/ [PG960] rm privkey.pem\n<\/pre>\n
The password which is asked for is the one you provided when you generated the certificate request above. The new key is now in “server.key”. Now you can create your certificate:<\/p>\n
\npostgres@pgbox:\/home\/postgres\/ [PG960] openssl req -x509 -in server.req -text -key server.key -out server.crt\n<\/pre>\n
If everything went well your brand new certificate should be available:<\/p>\n
\npostgres@pgbox:\/home\/postgres\/ [PG960] ls -l server.crt \n-rw-r--r--. 1 postgres postgres 4473 Sep  9 13:32 server.crt\npostgres@pgbox:\/home\/postgres\/ [PG960] cat server.crt\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number: 12528845138836301488 (0xaddf6645ea37a6b0)\n    Signature Algorithm: sha256WithRSAEncryption\n        Issuer: C=CH, ST=BS, L=Basel, O=dbi services, OU=dba, CN=pgbox\/emailAddress=xx@xx@com\n        Validity\n            Not Before: Sep  9 11:32:42 2016 GMT\n            Not After : Oct  9 11:32:42 2016 GMT\n        Subject: C=CH, ST=BS, L=Basel, O=dbi services, OU=dba, CN=pgbox\/emailAddress=xx@xx@com\n        Subject Public Key Info:\n            Public Key Algorithm: rsaEncryption\n                Public-Key: (2048 bit)\n                Modulus:\n                    00:cb:4f:d1:b7:81:c4:83:22:2f:fb:9f:4b:fa:6a:\n                    16:77:fd:62:37:91:f1:09:cc:c4:e1:04:e1:de:f2:\n                    3f:77:35:ec:e5:8f:5a:03:1d:7b:53:8e:5a:72:76:\n                    42:2a:cb:95:9a:35:4a:98:1d:78:3c:21:85:3d:7c:\n                    59:f6:e8:7b:20:d0:73:db:42:ff:38:ca:0c:13:f6:\n                    cc:3e:bc:b0:8f:41:29:f1:c7:33:45:79:c7:04:33:\n                    51:47:0b:23:f8:d6:58:68:2d:95:83:c9:ad:40:7c:\n                    95:9a:0c:ff:92:bd:d6:4f:b2:96:6c:41:45:0d:eb:\n                    19:57:b3:9a:fc:1c:82:01:9c:2d:e5:2e:1b:0f:47:\n                    ab:84:fa:65:ed:80:e7:19:da:ab:89:09:ed:6a:2c:\n                    3a:aa:fe:dc:ba:53:e5:52:3f:1c:db:47:4c:4a:d6:\n                    e5:0f:76:12:df:f4:6c:fd:5a:fb:a5:70:b4:7b:06:\n                    c3:0c:b1:4d:cf:04:8e:5c:b0:05:cb:f2:ac:78:a6:\n                    12:44:55:07:f9:88:55:59:23:11:0f:dd:53:14:6a:\n                    e8:c4:bb:6a:94:af:1e:54:e8:7d:4f:10:8a:e5:7e:\n                    31:3b:cf:28:28:80:37:62:eb:5e:49:26:9d:10:17:\n                    33:bc:a7:3f:2a:06:a4:f0:37:a5:b3:07:6d:ce:6a:\n                    b7:17\n                Exponent: 65537 (0x10001)\n        X509v3 extensions:\n            X509v3 Subject Key Identifier: \n                EA:63:B1:7F:07:DF:31:3F:55:28:77:CC:FB:F2:1F:3A:D6:45:3F:55\n            X509v3 Authority Key Identifier: \n                keyid:EA:63:B1:7F:07:DF:31:3F:55:28:77:CC:FB:F2:1F:3A:D6:45:3F:55\n\n            X509v3 Basic Constraints: \n                CA:TRUE\n    Signature Algorithm: sha256WithRSAEncryption\n         18:2b:96:b6:01:d8:3e:7f:bb:35:0c:4b:53:c2:9c:02:22:41:\n         25:82:d3:b6:a9:88:6e:0e:5d:5b:d3:ac:00:43:0a:04:f4:12:\n         6e:22:fd:3f:77:63:0e:42:28:e3:09:6b:16:67:5f:b7:08:08:\n         74:a3:55:1f:49:09:69:96:e8:f6:2e:9c:8a:d6:a0:e2:f7:d8:\n         30:62:06:f0:5e:1a:85:fe:ff:2d:39:64:f7:f1:e9:ce:21:02:\n         f3:86:5f:3b:f6:12:1d:61:cd:a8:bf:36:e2:98:d4:99:b6:95:\n         5e:05:87:8d:ab:2f:30:38:b2:fe:68:ac:50:8d:98:fd:aa:4d:\n         79:e2:f5:71:92:d6:e5:1d:59:42:02:49:7a:2e:e0:f3:ba:41:\n         4d:f4:15:33:44:36:14:43:3b:7a:41:1b:61:6c:ff:78:fb:13:\n         4a:a4:e0:96:6c:45:80:0e:30:e3:63:9d:dc:f1:77:16:22:9c:\n         7a:c9:92:96:53:3b:62:87:ca:cb:e8:4a:a4:4f:69:a6:a0:5a:\n         a9:eb:be:58:7f:c1:da:d4:d7:41:d4:54:06:fb:5b:8b:ea:46:\n         68:f5:e6:1e:2b:6a:0b:65:f9:66:5a:a2:14:ec:eb:05:2f:99:\n         46:bc:bb:d8:11:f6:3f:2e:6e:15:48:ac:70:1f:18:2d:e2:78:\n         4b:a3:cb:ef\n-----BEGIN CERTIFICATE-----\nMIIDxTCCAq2gAwIBAgIJAK3fZkXqN6awMA0GCSqGSIb3DQEBCwUAMHkxCzAJBgNV\nBAYTAkNIMQswCQYDVQQIDAJCUzEOMAwGA1UEBwwFQmFzZWwxFTATBgNVBAoMDGRi\naSBzZXJ2aWNlczEMMAoGA1UECwwDZGJhMQ4wDAYDVQQDDAVwZ2JveDEYMBYGCSqG\nSIb3DQEJARYJeHhAeHhAY29tMB4XDTE2MDkwOTExMzI0MloXDTE2MTAwOTExMzI0\nMloweTELMAkGA1UEBhMCQ0gxCzAJBgNVBAgMAkJTMQ4wDAYDVQQHDAVCYXNlbDEV\nMBMGA1UECgwMZGJpIHNlcnZpY2VzMQwwCgYDVQQLDANkYmExDjAMBgNVBAMMBXBn\nYm94MRgwFgYJKoZIhvcNAQkBFgl4eEB4eEBjb20wggEiMA0GCSqGSIb3DQEBAQUA\nA4IBDwAwggEKAoIBAQDLT9G3gcSDIi\/7n0v6ahZ3\/WI3kfEJzMThBOHe8j93Nezl\nj1oDHXtTjlpydkIqy5WaNUqYHXg8IYU9fFn26Hsg0HPbQv84ygwT9sw+vLCPQSnx\nxzNFeccEM1FHCyP41lhoLZWDya1AfJWaDP+SvdZPspZsQUUN6xlXs5r8HIIBnC3l\nLhsPR6uE+mXtgOcZ2quJCe1qLDqq\/ty6U+VSPxzbR0xK1uUPdhLf9Gz9WvulcLR7\nBsMMsU3PBI5csAXL8qx4phJEVQf5iFVZIxEP3VMUaujEu2qUrx5U6H1PEIrlfjE7\nzygogDdi615JJp0QFzO8pz8qBqTwN6WzB23OarcXAgMBAAGjUDBOMB0GA1UdDgQW\nBBTqY7F\/B98xP1Uod8z78h861kU\/VTAfBgNVHSMEGDAWgBTqY7F\/B98xP1Uod8z7\n8h861kU\/VTAMBgNVHRMEBTADAQH\/MA0GCSqGSIb3DQEBCwUAA4IBAQAYK5a2Adg+\nf7s1DEtTwpwCIkElgtO2qYhuDl1b06wAQwoE9BJuIv0\/d2MOQijjCWsWZ1+3CAh0\no1UfSQlpluj2LpyK1qDi99gwYgbwXhqF\/v8tOWT38enOIQLzhl879hIdYc2ovzbi\nmNSZtpVeBYeNqy8wOLL+aKxQjZj9qk154vVxktblHVlCAkl6LuDzukFN9BUzRDYU\nQzt6QRthbP94+xNKpOCWbEWADjDjY53c8XcWIpx6yZKWUztih8rL6EqkT2mmoFqp\n675Yf8Ha1NdB1FQG+1uL6kZo9eYeK2oLZflmWqIU7OsFL5lGvLvYEfY\/Lm4VSKxw\nHxgt4nhLo8vv\n-----END CERTIFICATE-----\n<\/pre>\n
For PostgreSQL to accept the key when it starts up you’ll need to modify the permissions:<\/p>\n
\npostgres@pgbox:\/home\/postgres\/ [PG960] chmod 600 server.key\npostgres@pgbox:\/home\/postgres\/ [PG960] ls -l server.key\n-rw-------. 1 postgres postgres 1675 Sep  9 13:30 server.key\n<\/pre>\n
Both files (server.key and server.crt) need to be copied to your data directory (you can adjust this by using the ssl_cert_file<\/a> and ssl_key_file<\/a> configuration parameters):<\/p>\n
\npostgres@pgbox:\/home\/postgres\/ [PG960] mv server.key server.crt $PGDATA\/\n<\/pre>\n
Now you can turn on ssl…<\/p>\n
\n(postgres@[local]:5432) [postgres] > alter system set ssl='on';\nALTER SYSTEM\nTime: 5.427 ms\n<\/pre>\n
… and restart your instance:<\/p>\n
\npostgres@pgbox:\/home\/postgres\/ [PG960] pg_ctl -D $PGDATA restart -m fast\n<\/pre>\n
How can you test if SSL connections do work? Add the following line to pg_hba.conf<\/a> for your instance:<\/p>\n
\nhostssl  all             all             127.0.0.1\/32            md5\n<\/pre>\n
Reload your server and then create a new connection:<\/p>\n
\npostgres@pgbox:\/u02\/pgdata\/PG1\/ [PG960] psql -h localhost -p 5432 postgres\npsql (9.6rc1 dbi services build)\nSSL connection (protocol: TLSv1.2, cipher: ECDHE-RSA-AES256-GCM-SHA384, bits: 256, compression: off)\nType \"help\" for help.\n<\/pre>\n
Works as expected. For everything which is not for testing you’ll need a real certificate, of course. Just in case you expected to configure another port: PostgreSQL listens for normal and SSL connections on the same port. When the client supports SSL then SSL connections will be established, otherwise normal connections. When you want to force the use of SSL connections you can do it by adjusting your pg_hba.conf (deny all connections which are not SSL).<\/p>\n","protected":false},"excerpt":{"rendered":"
Security is a big topic today and in the news almost every day. As the database usually holds sensitive data this data must be well protected. In most cases this is done by encrypting critical data inside the database and decrypt only when requested. But this is not all: When a client reads the data […]<\/p>\n","protected":false},"author":29,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[229],"tags":[447,77,25],"type_dbi":[],"class_list":["post-8830","post","type-post","status-publish","format-standard","hentry","category-database-administration-monitoring","tag-encryption","tag-postgresql","tag-security"],"acf":[],"yoast_head":"\nSecuring your connections to PostgreSQL by using SSL - dbi Blog<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.dbi-services.com\/blog\/securing-your-connections-to-postgresql-by-using-ssl\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Securing your connections to PostgreSQL by using SSL\" \/>\n<meta property=\"og:description\" content=\"Security is a big topic today and in the news almost every day. As the database usually holds sensitive data this data must be well protected. In most cases this is done by encrypting critical data inside the database and decrypt only when requested. But this is not all: When a client reads the data […]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.dbi-services.com\/blog\/securing-your-connections-to-postgresql-by-using-ssl\/\" \/>\n<meta property=\"og:site_name\" content=\"dbi Blog\" \/>\n<meta property=\"article:published_time\" content=\"2016-09-09T16:30:33+00:00\" \/>\n<meta name=\"author\" content=\"Daniel Westermann\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@westermanndanie\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Daniel Westermann\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"8 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.dbi-services.com\/blog\/securing-your-connections-to-postgresql-by-using-ssl\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.dbi-services.com\/blog\/securing-your-connections-to-postgresql-by-using-ssl\/\"},\"author\":{\"name\":\"Daniel Westermann\",\"@id\":\"https:\/\/www.dbi-services.com\/blog\/#\/schema\/person\/8d08e9bd996a89bd75c0286cbabf3c66\"},\"headline\":\"Securing your connections to PostgreSQL by using SSL\",\"datePublished\":\"2016-09-09T16:30:33+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.dbi-services.com\/blog\/securing-your-connections-to-postgresql-by-using-ssl\/\"},\"wordCount\":518,\"commentCount\":0,\"keywords\":[\"encryption\",\"PostgreSQL\",\"Security\"],\"articleSection\":[\"Database Administration & Monitoring\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/www.dbi-services.com\/blog\/securing-your-connections-to-postgresql-by-using-ssl\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.dbi-services.com\/blog\/securing-your-connections-to-postgresql-by-using-ssl\/\",\"url\":\"https:\/\/www.dbi-services.com\/blog\/securing-your-connections-to-postgresql-by-using-ssl\/\",\"name\":\"Securing your connections to PostgreSQL by using SSL - dbi Blog\",\"isPartOf\":{\"@id\":\"https:\/\/www.dbi-services.com\/blog\/#website\"},\"datePublished\":\"2016-09-09T16:30:33+00:00\",\"author\":{\"@id\":\"https:\/\/www.dbi-services.com\/blog\/#\/schema\/person\/8d08e9bd996a89bd75c0286cbabf3c66\"},\"breadcrumb\":{\"@id\":\"https:\/\/www.dbi-services.com\/blog\/securing-your-connections-to-postgresql-by-using-ssl\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.dbi-services.com\/blog\/securing-your-connections-to-postgresql-by-using-ssl\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.dbi-services.com\/blog\/securing-your-connections-to-postgresql-by-using-ssl\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Accueil\",\"item\":\"https:\/\/www.dbi-services.com\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Securing your connections to PostgreSQL by using SSL\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.dbi-services.com\/blog\/#website\",\"url\":\"https:\/\/www.dbi-services.com\/blog\/\",\"name\":\"dbi Blog\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.dbi-services.com\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.dbi-services.com\/blog\/#\/schema\/person\/8d08e9bd996a89bd75c0286cbabf3c66\",\"name\":\"Daniel Westermann\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/secure.gravatar.com\/avatar\/31350ceeecb1dd8986339a29bf040d4cd3cd087d410deccd8f55234466d6c317?s=96&d=mm&r=g\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/31350ceeecb1dd8986339a29bf040d4cd3cd087d410deccd8f55234466d6c317?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/31350ceeecb1dd8986339a29bf040d4cd3cd087d410deccd8f55234466d6c317?s=96&d=mm&r=g\",\"caption\":\"Daniel Westermann\"},\"description\":\"Daniel Westermann is Principal Consultant and Technology Leader Open Infrastructure at dbi services. He has more than 15 years of experience in management, engineering and optimization of databases and infrastructures, especially on Oracle and PostgreSQL. Since the beginning of his career, he has specialized in Oracle Technologies and is Oracle Certified Professional 12c and Oracle Certified Expert RAC\/GridInfra. Over time, Daniel has become increasingly interested in open source technologies, becoming \u201cTechnology Leader Open Infrastructure\u201d and PostgreSQL expert. \u00a0Based on community or EnterpriseDB tools, he develops and installs complex high available solutions with PostgreSQL. He is also a certified PostgreSQL Plus 9.0 Professional and a Postgres Advanced Server 9.4 Professional. He is a regular speaker at PostgreSQL conferences in Switzerland and Europe. Today Daniel is also supporting our customers on AWS services such as AWS RDS, database migrations into the cloud, EC2 and automated infrastructure management with AWS SSM (System Manager). He is a certified AWS Solutions Architect Professional. Prior to dbi services, Daniel was Management System Engineer at LC SYSTEMS-Engineering AG in Basel. Before that, he worked as Oracle Developper &\u00a0Project Manager at Delta Energy Solutions AG in Basel (today Powel AG). Daniel holds a diploma in Business Informatics (DHBW, Germany). His branch-related experience mainly covers the pharma industry, the financial sector, energy, lottery and telecommunications.\",\"sameAs\":[\"https:\/\/x.com\/westermanndanie\"],\"url\":\"https:\/\/www.dbi-services.com\/blog\/author\/daniel-westermann\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Securing your connections to PostgreSQL by using SSL - dbi Blog","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.dbi-services.com\/blog\/securing-your-connections-to-postgresql-by-using-ssl\/","og_locale":"en_US","og_type":"article","og_title":"Securing your connections to PostgreSQL by using SSL","og_description":"Security is a big topic today and in the news almost every day. As the database usually holds sensitive data this data must be well protected. In most cases this is done by encrypting critical data inside the database and decrypt only when requested. But this is not all: When a client reads the data […]","og_url":"https:\/\/www.dbi-services.com\/blog\/securing-your-connections-to-postgresql-by-using-ssl\/","og_site_name":"dbi Blog","article_published_time":"2016-09-09T16:30:33+00:00","author":"Daniel Westermann","twitter_card":"summary_large_image","twitter_creator":"@westermanndanie","twitter_misc":{"Written by":"Daniel Westermann","Est. reading time":"8 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.dbi-services.com\/blog\/securing-your-connections-to-postgresql-by-using-ssl\/#article","isPartOf":{"@id":"https:\/\/www.dbi-services.com\/blog\/securing-your-connections-to-postgresql-by-using-ssl\/"},"author":{"name":"Daniel Westermann","@id":"https:\/\/www.dbi-services.com\/blog\/#\/schema\/person\/8d08e9bd996a89bd75c0286cbabf3c66"},"headline":"Securing your connections to PostgreSQL by using SSL","datePublished":"2016-09-09T16:30:33+00:00","mainEntityOfPage":{"@id":"https:\/\/www.dbi-services.com\/blog\/securing-your-connections-to-postgresql-by-using-ssl\/"},"wordCount":518,"commentCount":0,"keywords":["encryption","PostgreSQL","Security"],"articleSection":["Database Administration & Monitoring"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.dbi-services.com\/blog\/securing-your-connections-to-postgresql-by-using-ssl\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.dbi-services.com\/blog\/securing-your-connections-to-postgresql-by-using-ssl\/","url":"https:\/\/www.dbi-services.com\/blog\/securing-your-connections-to-postgresql-by-using-ssl\/","name":"Securing your connections to PostgreSQL by using SSL - dbi Blog","isPartOf":{"@id":"https:\/\/www.dbi-services.com\/blog\/#website"},"datePublished":"2016-09-09T16:30:33+00:00","author":{"@id":"https:\/\/www.dbi-services.com\/blog\/#\/schema\/person\/8d08e9bd996a89bd75c0286cbabf3c66"},"breadcrumb":{"@id":"https:\/\/www.dbi-services.com\/blog\/securing-your-connections-to-postgresql-by-using-ssl\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.dbi-services.com\/blog\/securing-your-connections-to-postgresql-by-using-ssl\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.dbi-services.com\/blog\/securing-your-connections-to-postgresql-by-using-ssl\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Accueil","item":"https:\/\/www.dbi-services.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Securing your connections to PostgreSQL by using SSL"}]},{"@type":"WebSite","@id":"https:\/\/www.dbi-services.com\/blog\/#website","url":"https:\/\/www.dbi-services.com\/blog\/","name":"dbi Blog","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.dbi-services.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/www.dbi-services.com\/blog\/#\/schema\/person\/8d08e9bd996a89bd75c0286cbabf3c66","name":"Daniel Westermann","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/31350ceeecb1dd8986339a29bf040d4cd3cd087d410deccd8f55234466d6c317?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/31350ceeecb1dd8986339a29bf040d4cd3cd087d410deccd8f55234466d6c317?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/31350ceeecb1dd8986339a29bf040d4cd3cd087d410deccd8f55234466d6c317?s=96&d=mm&r=g","caption":"Daniel Westermann"},"description":"Daniel Westermann is Principal Consultant and Technology Leader Open Infrastructure at dbi services. He has more than 15 years of experience in management, engineering and optimization of databases and infrastructures, especially on Oracle and PostgreSQL. Since the beginning of his career, he has specialized in Oracle Technologies and is Oracle Certified Professional 12c and Oracle Certified Expert RAC\/GridInfra. Over time, Daniel has become increasingly interested in open source technologies, becoming \u201cTechnology Leader Open Infrastructure\u201d and PostgreSQL expert. \u00a0Based on community or EnterpriseDB tools, he develops and installs complex high available solutions with PostgreSQL. He is also a certified PostgreSQL Plus 9.0 Professional and a Postgres Advanced Server 9.4 Professional. He is a regular speaker at PostgreSQL conferences in Switzerland and Europe. Today Daniel is also supporting our customers on AWS services such as AWS RDS, database migrations into the cloud, EC2 and automated infrastructure management with AWS SSM (System Manager). He is a certified AWS Solutions Architect Professional. Prior to dbi services, Daniel was Management System Engineer at LC SYSTEMS-Engineering AG in Basel. Before that, he worked as Oracle Developper &\u00a0Project Manager at Delta Energy Solutions AG in Basel (today Powel AG). Daniel holds a diploma in Business Informatics (DHBW, Germany). His branch-related experience mainly covers the pharma industry, the financial sector, energy, lottery and telecommunications.","sameAs":["https:\/\/x.com\/westermanndanie"],"url":"https:\/\/www.dbi-services.com\/blog\/author\/daniel-westermann\/"}]}},"_links":{"self":[{"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/posts\/8830","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/users\/29"}],"replies":[{"embeddable":true,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/comments?post=8830"}],"version-history":[{"count":0,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/posts\/8830\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/media?parent=8830"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/categories?post=8830"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/tags?post=8830"},{"taxonomy":"type","embeddable":true,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/type_dbi?post=8830"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}