ssl_sni

Definition PG 20 devel manual

Enables SNI configuration for SSL connections. When set to on host configuration from hosts_file is used, see Section 18.9.6 for more details.

This parameter can only be set in the postgresql.conf file or on the server command line. The default is off.

How it works

PostgreSQL describes ssl_sni as follows: “Sets whether to interpret SNI extensions in SSL connections.” A configuration reload applies the value to the server without a full restart. The atlas measures it in PG19 Beta 3; boot_val is the compiled or initialized baseline, not proof of a running cluster's effective setting.

When enabled with TLS, PostgreSQL reads the client's Server Name Indication and selects credentials through hosts_file. Hostnames match case-insensitively; /no_sni/ and * provide explicit fallback behavior. Certificate identity, client verification, CRLs, permissions, and reload failures still require independent validation.

Read it together with hosts_file, ssl, ssl_cert_file, ssl_key_file. Check SHOW and pg_settings on the target server, verify the source and pending_restart fields, and compare workload, logs, and resource metrics before and after any change.

Operational considerations

Treating the measured boot_val for ssl_sni as proof of the effective value on an initialized or managed cluster.

Applying a change as though it were immediate while pg_settings reports sighup context.

Changing this setting in isolation without checking the linked limits, observability, and rollback path.

Depending on beta behavior in production without retesting the PostgreSQL 19 final release.

Workload guidance

OLAP: Apply the same security policy to batch drivers and long-lived ETL connections. Test clients that omit SNI, credential-expiry automation, reload behavior, and certificate-chain compatibility.

OLTP: Roll out through staged clients, validate certificate selection and expiry warnings, and monitor authentication failures. Keep a tested fallback and treat file permissions and secret rotation as part of the same change.

SMALL: Prefer a simple, documented TLS and credential policy. Do not enable multi-certificate routing without a test for every hostname and fallback path, and never weaken verification to hide configuration mistakes.