Skip to content

Commit

Permalink
docs(sdb): update
Browse files Browse the repository at this point in the history
  • Loading branch information
SamyOubouaziz committed Jun 6, 2024
1 parent 79f3f20 commit c91f33e
Showing 1 changed file with 11 additions and 11 deletions.
22 changes: 11 additions & 11 deletions serverless/sql-databases/how-to/secure-connection-ssl-tls.mdx
Original file line number Diff line number Diff line change
@@ -1,10 +1,10 @@
---
meta:
title: Secure connections using SSL/TLS
description: This page explains how to to configure SSL/TLS to encrypt traffic between your client and Serverless SQL Databases
description: This page explains how to configure SSL/TLS to encrypt traffic between your client and Serverless SQL Databases
content:
h1: Secure connections using SSL/TLS
paragraph: This page explains how to to configure SSL/TLS to encrypt traffic between your client and Serverless SQL Databases
paragraph: This page explains how to configure SSL/TLS to encrypt traffic between your client and Serverless SQL Databases
dates:
validation: 2024-06-03
posted: 2024-06-03
Expand All @@ -22,7 +22,7 @@ Configuration examples for languages, frameworks and tools:

## Generic configuration settings

Starting from PostgreSQL 16, you can setup SSL/TLS to rely on the default certification authority certificates trusted by your operating system. To do so, use the additional configuration parameters `sslmode=verify-full` and `sslrootcert=system`.
Starting from PostgreSQL 16, you can set up SSL/TLS to rely on the default certification authority certificates trusted by your operating system. To do so, use the additional configuration parameters `sslmode=verify-full` and `sslrootcert=system`.

For instance, your full connection string should be:
```sh
Expand All @@ -34,7 +34,7 @@ Support for `sslmode=verify-full` and `sslrootcert=system` options can vary amon

With this configuration, on your SQL client side, you will not need to download, update or renew certificates separately for PostgreSQL.

Keeping your operating system up to date is enough to ensure your traffic is encrypted, and your client send messages to the right server (protecting you against [Eavesdropping](https://en.wikipedia.org/wiki/Network_eavesdropping) and [Man In The Middle Attacks](https://en.wikipedia.org/wiki/Man-in-the-middle_attack)).
Keeping your operating system up to date is enough to ensure your traffic is encrypted, and that your client sends messages to the right server (protecting you against [Eavesdropping](https://en.wikipedia.org/wiki/Network_eavesdropping) and [Man In The Middle Attacks](https://en.wikipedia.org/wiki/Man-in-the-middle_attack)).

Alternatively, you can also download the trusted root Certificate used to sign our domain: [Let's Encrypt ISRG Root X1 (pem format)](https://letsencrypt.org/certs/isrgrootx1.pem), and use `sslmode=verify-full` and `sslrootcert=~/.postgresql/isrgx1root.pem`.

Expand All @@ -52,7 +52,7 @@ Refer to the official [PostgreSQL documentation](https://www.postgresql.org/docs

As [psycopg2](https://pypi.org/project/psycopg2/) uses [libpq](https://www.postgresql.org/docs/current/libpq.html), the same official PostgreSQL parameter can be used.

Edit your connecton parameters to add `sslmode=verify-full` and `sslrootcert=system` as shown below:
Edit your connection parameters to add `sslmode=verify-full` and `sslrootcert=system` as shown below:
```python
conn = psycopg2.connect(host={host},port={port},database={port},user={username},password={password},sslmode="verify-full",sslrootcert="system")
```
Expand Down Expand Up @@ -103,17 +103,17 @@ const client = new Client({

### Node.js/Postgres.js

[Postgres.js](https://github.com/porsager/postgres) doesn't support `sslmode=verify-full` and `sslrootcert=system`, but either default connection string option `sslmode=require` or driver specific parameter `ssl:true` option checks for certificate validity.
[Postgres.js](https://github.com/porsager/postgres) doesn't support `sslmode=verify-full` and `sslrootcert=system`, but either the default connection string option `sslmode=require` or the driver-specific parameter `ssl:true` option checks for certificate validity.

To ensure SSL/TLS is enforced and server certificate is valid, edit your connection parameters to add `ssl:true` parameters:
To ensure SSL/TLS is enforced and the server certificate is valid, edit your connection parameters to add `ssl:true` parameters:

```js
const sql = postgres({
host: {host}, //Host formated as {database-id}.pg.sdb.{region}.scw.cloud
port: {port}, //Default port for PostgreSQL is supported: 5432
database: {username},
user: {username}, //IAM principal ID of the user or application your are connecting with
password: {username}, //IAM Secret Key of the user or application your are connecting with
user: {username}, //IAM principal ID of the user or application you are connecting with
password: {username}, //IAM Secret Key of the user or application you are connecting with
ssl:true
});
```
Expand All @@ -124,7 +124,7 @@ You can use several drivers with [Prisma](https://www.prisma.io/docs/orm/overvie

By default, Prisma uses its built-in PostgreSQL driver which doesn't support `sslmode=verify-full` and `sslrootcert=system`, but can perform certificate validity checks by using the `sslmode=require` and `sslaccept=strict` parameters.

To ensure SSL/TLS is enforced and server certificate is valid, add these two parameters to your connection string in your `.env` file:
To ensure SSL/TLS is enforced and the server certificate is valid, add these two parameters to your connection string in your `.env` file:

```sh
DATABASE_URL=postgresql://{username}:{password}@{host}:{port}/{databasename}?sslmode=require&sslaccept=strict
Expand Down Expand Up @@ -163,7 +163,7 @@ Alternatively, you can add the property `"sslrootcert=full/path/to/certificate/i

As the official client bundled with PostgreSQL, [psql](https://www.postgresql.org/docs/current/app-psql.html) supports the default PostgreSQL connections parameters.

Edit your connecton parameters to add `sslmode=verify-full` and `sslrootcert=system` parameters:
Edit your connection parameters to add `sslmode=verify-full` and `sslrootcert=system` parameters:

```sh
psql "postgresql://{username}:{password}@{host}:{port}/{databasename}?sslmode=verify-full&sslrootcert=system"
Expand Down

0 comments on commit c91f33e

Please sign in to comment.