sslmode

Description

This option determines whether or with what priority a secure SSL TCP/IP connection will be negotiated with the server. There are six modes:

Client library

libpq 18.6

Manual definition

Documented

Source environment fallback

PGSSLMODE

Compiled fallback expression

DefaultSSLMode

Usage

sslmode

Default resolution and service-file precedence

The following environment variables can be used to select default connection parameter values, which will be used by PQconnectdb , PQsetdbLogin and PQsetdb if no value is directly specified by the calling code. These are useful to avoid hard-coding database connection information into simple client applications, for example.

Service names can be defined in either a per-user service file or a system-wide file. If the same service name exists in both the user and the system file, the user file takes precedence. By default, the per-user service file is named ~/.pg_service.conf . On Microsoft Windows, it is named %APPDATA%\postgresql\.pg_service.conf (where %APPDATA% refers to the Application Data subdirectory in the user's profile). A different file name can be specified by setting the environment variable PGSERVICEFILE . The system-wide file is named pg_service.conf . By default it is sought in the etc directory of the PostgreSQL installation (use pg_config --sysconfdir to identify this directory precisely). Another directory, but not a different file name, can be specified by setting the environment variable PGSYSCONFDIR .

Connection parameters obtained from a service file are combined with parameters obtained from other sources. A service file setting overrides the corresponding environment variable, and in turn can be overridden by a value given directly in the connection string. For example, using the above service file, a connection string service=mydb port=5434 will use host somehost , port 5434 , user admin , and other parameters as set by environment variables or built-in defaults.

Environment variable evidence

PGSSLMODE behaves the same as the sslmode connection parameter.

Related entries

• Connection service file
• Password file
• All libpq environment variables

Documentation and source

• 18.6 English manual · libpq-connect.html
• 18.6 libpq connection option declarations
• 18.6 English manual · libpq-envars.html
• 18.6 English manual · libpq-pgservice.html

Compare versions

PostgreSQL 19 → 20: changed.

--- PostgreSQL 19
+++ PostgreSQL 20
@@ -1,7 +1,7 @@
 {
   "compiled_default_expression": "DefaultSSLMode",
   "default_evidence": [],
-  "definition": "This option determines whether or with what priority a secure SSL TCP/IP connection will be negotiated with the server. There are six modes: disable only try a non- SSL connection allow first try a non- SSL connection; if that fails, try an SSL connection prefer (default) first try an SSL connection; if that fails, try a non- SSL connection require only try an SSL connection. If a root CA file is present, verify the certificate in the same way as if verify-ca was specified verify-ca only try an SSL connection, and verify that the server certificate is issued by a trusted certificate authority ( CA ) verify-full only try an SSL connection, verify that the server certificate is issued by a trusted CA and that the requested server host name matches that in the certificate See Section 32.19 for a detailed description of how these options work. sslmode is ignored for Unix domain socket communication. If PostgreSQL is compiled without SSL support, using options require , verify-ca , or verify-full will cause an error, while options allow and prefer will be accepted but libpq will not actually attempt an SSL connection. Note that if GSSAPI encryption is possible, that will be used in preference to SSL encryption, regardless of the value of sslmode . To force use of SSL encryption in an environment that has working GSSAPI infrastructure (such as a Kerberos server), also set gssencmode to disable .",
+  "definition": "This option determines whether or with what priority a secure SSL TCP/IP connection will be negotiated with the server. There are six modes: disable only try a non- SSL connection allow first try a non- SSL connection; if that fails, try an SSL connection prefer (default) first try an SSL connection; if that fails, try a non- SSL connection require only try an SSL connection. If a root CA file is present, verify the certificate in the same way as if verify-ca was specified verify-ca only try an SSL connection, and verify that the server certificate is issued by a trusted certificate authority ( CA ) verify-full only try an SSL connection, verify that the server certificate is issued by a trusted CA and that the requested server host name matches that in the certificate See Section 32.18 for a detailed description of how these options work. sslmode is ignored for Unix domain socket communication. If PostgreSQL is compiled without SSL support, using options require , verify-ca , or verify-full will cause an error, while options allow and prefer will be accepted but libpq will not actually attempt an SSL connection. Note that if GSSAPI encryption is possible, that will be used in preference to SSL encryption, regardless of the value of sslmode . To force use of SSL encryption in an environment that has working GSSAPI infrastructure (such as a Kerberos server), also set gssencmode to disable .",
   "documented": true,
   "environment": "PGSSLMODE",
   "keyword": "sslmode"

Compares recorded interfaces and attributes. Source fingerprints and build metadata are excluded; an absent sample is not proof of the introduction or removal release.

Related entries

• requiressl
• ssl_max_protocol_version
• ssl_min_protocol_version
• sslcert
• sslcertmode
• sslcompression
• sslcrl
• sslcrldir
• sslkey
• sslkeylogfile
• sslnegotiation
• sslpassword