All Products
Search
Document Center

Hologres:Encryption in transit

Last Updated:Jun 03, 2026

Enable SSL encryption to protect data transmitted between clients and Hologres instances. SSL uses TLS to establish encrypted connections that safeguard data confidentiality and integrity.

SSL encrypts network connections at the transport layer, improving security at the cost of increased connection latency.

When to use SSL encryption

  • Remote database access: Encrypt connections from clients that access a Hologres database over a public or untrusted network.

  • Security and compliance: Meet industry standards and regulatory requirements that mandate encryption for data in transit.

SSL modes

Hologres supports the following SSL modes, each with a different level of verification during the SSL handshake.

SSL mode

Description

Certificate required

Minimum version

require

Encrypts the data link. Does not verify server identity.

No

V1.1

verify-ca

Encrypts the data link and authenticates the server with a CA certificate.

Yes

V2.1

verify-full

Encrypts the data link, authenticates the server with a CA certificate, and verifies that the certificate CN (Common Name) or DNS matches the configured Hologres endpoint.

Yes

V2.1

disable

Does not use encryption in transit.

No

N/A

Version requirements

Version

SSL capability

V1.1 and later

Encryption in transit

V1.2 and later

TLS

V2.1 and later

Encryption in transit with CA certificates; self-service enablement in the console

Note

If your instance is earlier than V1.1, submit your feedback using Common upgrade preparation failure errors or by joining the Hologres DingTalk group. For more information, see How do I get more online support?.

Prerequisites

Ensure that you have:

Enable encryption in transit

  1. Log on to the Hologres management console and select a region in the upper-left corner.

  2. In the left-side navigation pane, click Instances, and then click the ID of the target instance.

  3. On the instance page, click Data Security.

  4. On the SSL tab, turn on the SSL Encryption switch.

  5. In the Enable SSL Encryption dialog box, click Enable SSL Encryption.

Download the CA certificate

Hologres provides an instance CA certificate for server authentication. The certificate is required for verify-ca and verify-full modes.

  1. Log on to the Hologres management console and select a region in the upper-left corner.

  2. In the left-side navigation pane, click Instances, and then click the ID of the target instance.

  3. On the instance page, click Data Security.

  4. On the SSL tab, click Download Certificate.

Connect with SSL encryption

After you enable SSL, connect to Hologres using PSQL or JDBC. If you use verify-ca or verify-full mode, download the CA certificate first.

Connect by using PSQL

Run the following command to connect:

PG_USER=<AccessKey ID>
PG_PASSWORD=<AccessKey secret>
PG_SSLMODE=<SSL Mode>
PG_SSLROOTCERT=<certificate folder>
PGSSLMODE=$PG_SSLMODE PGSSLROOTCERT=$PG_SSLROOTCERT PGUSER=$PG_USER PGPASSWORD=$PG_PASSWORD psql -p <Port> -h <Endpoint> -d <Database>

The following table describes the parameters.

Parameter

Description

AccessKey ID

The AccessKey ID of your Alibaba Cloud account. Obtain it from AccessKey Management. Store credentials in environment variables to avoid leaks.

AccessKey secret

The AccessKey secret of your Alibaba Cloud account. Obtain it from AccessKey Management. Store credentials in environment variables to avoid leaks.

SSL Mode

The SSL mode for the connection. Valid values: require, verify-ca, verify-full, disable. For details, see SSL modes.

certificate folder

The path to the CA certificate file. Required when SSL Mode is set to verify-ca or verify-full.

Port

The public port of the Hologres instance. Example: 80.

Endpoint

The public endpoint of the Hologres instance. Example: xxx-cn-hangzhou.hologres.aliyuncs.com.

Database

The name of the Hologres database. The default postgres database has limited resources. Create a database for production workloads. For more information, see Create a database. Example: mydb.

Verify the connection

If you set PGSSLMODE to require, the following output indicates that an SSL-encrypted connection is active:

Encryption in transit

Connect by using JDBC

The ssl and sslmode connection properties control SSL behavior. The outcome depends on the combination of client properties and the server-side SSL setting.

Instance SSL enabled

ssl

sslmode

Result

Yes

true

require, verify-ca, or verify-full

Connected. Encryption in transit is used.

Yes

false

require, verify-ca, or verify-full

Connected. Encryption in transit is not used.

No

true

require, verify-ca, or verify-full

Connection fails with an error. image.png

No

false

require, verify-ca, or verify-full

Connected. Encryption in transit is not used.

Example code

// Set the endpoint of the Hologres instance.
String hostname = "hgxxxxxxx-cn-hangzhou-vpc.hologres.aliyuncs.com";
// Set the port of the Hologres instance.
String port = "80";
// Set the name of the database to connect to.
String dbname = "postgres";

String jdbcUrl = "jdbc:postgresql://" + hostname + ":" + port + "/" + dbname + "?binaryTransfer=true";

Properties properties = new Properties();
// Set the username for the database connection.
// Use environment variables to reduce the risk of credential leaks.
properties.setProperty("user", System.getenv("ALIBABA_CLOUD_USER"));
// Set the password for the database connection.
// Use environment variables to reduce the risk of credential leaks.
properties.setProperty("password", System.getenv("ALIBABA_CLOUD_PASSWORD"));

// Enable SSL.
properties.setProperty("ssl", "true");

// Set the path to the CA root certificate.
properties.setProperty("sslrootcert", path + "/" + "hologres_certificate.crt");

// Set the SSL mode. Valid values: require, verify-ca, verify-full.
properties.setProperty("sslmode", "verify-full");

try {
    Class.forName("org.postgresql.Driver");
    Connection connection = DriverManager.getConnection(jdbcUrl, properties);
    // In this example, assume that a table named example exists in the postgres database.
    // The following code queries data from the example table.
    PreparedStatement preparedStatement = connection.prepareStatement("select * from " +
            "example");
    ResultSet resultSet = preparedStatement.executeQuery();
    while (resultSet.next()) {
        ResultSetMetaData rsmd = resultSet.getMetaData();
        int columnCount = rsmd.getColumnCount();
        Map map = new HashMap();
        for (int i = 0; i < columnCount; i++) {
            map.put(rsmd.getColumnName(i + 1).toLowerCase(), resultSet.getObject(i + 1));
        }
        System.out.println(map);
    }
} catch (Exception exception) {
    exception.printStackTrace();
}

Considerations

Instance restart and downtime

Enabling, disabling, or renewing SSL requires an instance restart (~3 minutes). Schedule these operations during off-peak hours.

SSL connection behavior

Scenario

Behavior

SSL disabled (default)

Only non-SSL connections are supported.

SSL enabled

Clients can connect with or without SSL, but must specify the connection mode explicitly.

SSL disabled after being enabled

Only non-SSL connections are supported.

Configuration changed

Reconnect existing connections for changes to take effect.

Performance impact

Enabling SSL encryption increases CPU utilization and read/write latency.

Certificate validity

The SSL certificate expires after one year. Renew it before expiration, or SSL-encrypted connections will fail.