Enforce client SSL connections for RDS for PostgreSQL - ApsaraDB RDS

After enabling SSL encryption, clients can still connect without SSL by using the PGSSLMODE=disable parameter if client access control is not configured. To enforce SSL connections for all clients, follow the steps in this topic.

Prerequisites

Your RDS for PostgreSQL instance must have SSL encryption enabled. For more information, see Quickly enable SSL encryption by using a cloud certificate or Enable SSL encryption by using a custom certificate.
If you plan to use Method 1, you must configure a client CA certificate to verify client certificates. For more information, see Configure a client CA certificate.

Procedure

RDS for PostgreSQL provides the following methods to enforce SSL encryption for client connections.

Method 1: Client ACL

After configuring a client CA certificate, you can set up a client ACL on your RDS for PostgreSQL instance to manage client access. Clients must then present a valid client certificate and private key and use the specified authentication method to connect to the database.

Note

Configuring the client ACL makes your PostgreSQL database instance unavailable for about one minute.
If client access control is not configured on your RDS for PostgreSQL database, the authentication method defaults to prefer. This allows clients to connect without SSL by using PGSSLMODE=disable. To block non-SSL connections, configure the client ACL to use an authentication method other than prefer after enabling SSL encryption.

Click Modify next to Configure ACL and select a client connection control mode.

You can use one of the following authentication methods to enforce SSL connections to your RDS for PostgreSQL instance:

cert: Authenticates using a client certificate instead of a password. It encrypts the connection, verifies the client certificate, and checks that the Common Name (CN) in the certificate matches the database username.
verify-ca: Encrypts the connection and verifies the client certificate against the configured CA.
verify-full (supported on RDS for PostgreSQL 12 and later): Encrypts the connection, verifies the client certificate against the configured CA, and checks that the CN in the certificate matches the database username.

Method 2: pg_hba.conf file

After enabling SSL encryption, you can use the AD Domain Service Configuration feature in RDS for PostgreSQL to modify the pg_hba.conf file. This forces clients to use SSL when connecting to the database.

Go to the Instances page. In the top navigation bar, select the region in which the RDS instance resides. Then, find the RDS instance and click the ID of the instance.
In the left-side navigation pane, click Accounts, and then click the AD Domain Services tab.
In the rules table on the pg_hba.conf configuration page, modify the first record by setting TYPE to hostssl, DATABASE and USER to all, ADDRESS to 0.0.0.0/0, and METHOD to md5.
Click Submit.

Note
After clicking Submit, the instance status changes to Maintaining Instance for about one minute. The new configuration applies only to new connections. To apply the change to existing connections, you must disconnect and then reconnect.