Platform

Postgres SSL Enforcement

Your Supabase project supports connecting to the Postgres DB without SSL enabled to maximize client compatibility. For increased security, you can prevent clients from connecting if they're not using SSL.

SSL enforcement only applies to connections to both Postgres and Supavisor ("Connection Pooler"); all HTTP APIs offered by Supabase (e.g., PostgREST, Storage, Auth) automatically enforce SSL on all incoming connections.

Manage SSL enforcement via the dashboard

SSL enforcement can be configured via the "Enforce SSL on incoming connections" setting under the SSL Configuration section in Database Settings page of the dashboard.

Manage SSL enforcement via the CLI

To get started:

  1. Install the Supabase CLI 1.37.0+.
  2. Log in to your Supabase account using the CLI.
  3. Ensure that you have Owner or Admin permissions for the project that you are enabling SSL enforcement.

Check enforcement status

You can use the get subcommand of the CLI to check whether SSL is currently being enforced:


_10
> supabase ssl-enforcement --project-ref {ref} get --experimental
_10
SSL is being enforced.

Or similarly, if SSL is not being enforced, you will see:


_10
> supabase ssl-enforcement --project-ref {ref} get --experimental
_10
SSL is *NOT* being enforced.

Update enforcement

The update subcommand is used to change the SSL enforcement status for your project:


_10
> supabase ssl-enforcement --project-ref {ref} update --enable-db-ssl-enforcement --experimental
_10
SSL is now being enforced.

Similarly, to disable SSL enforcement:


_10
> supabase ssl-enforcement --project-ref {ref} update --disable-db-ssl-enforcement --experimental
_10
SSL is *NOT* being enforced.

A note about Postgres SSL modes

Postgres supports multiple SSL modes on the client side. These modes provide different levels of protection. Depending on your needs, it is important to verify that the SSL mode in use is performing the required level of enforcement and verification of SSL connections.

The strongest mode offered by Postgres is verify-full and this is the mode you most likely want to use when SSL enforcement is enabled. To use verify-full you will need to download the Supabase CA certificate for your database. The certificate is available through the dashboard under the SSL Configuration section in the Database Settings page.

Once the CA certificate has been downloaded, add it to the certificate authority list used by Postgres.


_10
> cat {location of downloaded prod-ca-2021.crt} >> ~/.postgres/root.crt

With the CA certificate added to the trusted certificate authorities list, use psql or your client library to connect to Supabase:


_10
> psql "postgresql://aws-0-eu-central-1.pooler.supabase.com:6543/postgres?sslmode=verify-full" -U postgres.<user>