ODBC Driver for PostgreSQL

SSL Connection to PostgreSQL via ODBC Driver

Connecting to PostgreSQL Using SSL

SSL (Secure Sockets Layer) is a standard protocol for secure access to a remote machine over untrusted networks. It runs on top of TCP/IP to secure client-server communications by allowing an SSL-enabled client to authenticate itself to an SSL-enabled server and vice versa. During server authentication, an SSL-enabled client application uses standard techniques of public-key cryptography to verify the server's identity by checking that the server's certificate is issued by a trusted certificate authority (CA) and proves the ownership of the public key.

Conversely, SSL client authentication allows the server to validate the client's identity. The client and server can also authenticate each other using self-signed certificates, however, you will almost never want to use a self-signed certificate, except for an Intranet or a development server. After establishing an SSL connection, the client and server can exchange messages that are symmetrically encrypted with the shared secret key. SSL is the recommended method to establish a secure connection to PostgreSQL due to easier configuration and higher performance, compared to SSH. See the PostgreSQL documentation for more information on how to secure TCP/IP connections with SSL .

To establish an SSL connection to PostgreSQL, specify the SSL certificates and client private key:

PostgreSQL SSL Connection

SSL Options

Option

Description

Use SSL

Enables SSL connections.

CA Certificate

The CA certificate.

Certificate

The client certificate.

Key

The private client key.

Ignore Server Certificate Validity

Specifies whether to check the server certificate validity period during an SSL handshake. The default value is True.

Ignore Server Certificate Constraints

Specifies whether to verify the server certificate for compliance with constraints during an SSL handshake. The default value is True.

Trust Server Certificate

Specifies whether to verify the server certificate during an SSL handshake. By default, the driver verifies the server certificate. When the option is set to True, the driver will bypass walking the certificate chain to verify the certificate.

Ignore Server Certificate Insecurity

Specifes whether to check the server certificate signature security during an SSL handshake. The default value is False.

Mode

Specifies whether and with what priority an SSL connection will be negotiated with the server.


smRequire
The default value. Only SSL connections allowed.

smPrefer
Negotiates trying first an SSL connection, then if that fails, tries a regular non-SSL connection.

smAllow
Negotiates trying first a non-SSL connection, then if that fails, tries an SSL connection.

smVerifyCA
Verifies server identity by validating the server certificate chain up to the root certificate installed on the client machine.

smVerifyFull
Verifies server identity by validating the server certificate chain up to the root certificate installed on the client machine and validates that the server hostname matches the server certificate.

Sample SSL Connection String

DRIVER={Devart ODBC Driver for PostgreSQL};Data Source=myServer;Port=myPort;Database=myDatabase;User ID=myUsername;Password=myPassword;Schema=mySchema;Use SSL=True;SSL CACert=C:\myCaCertificate.pem;SSL Cert=C:\myClientCertificate.pem;Key=C:\myPrivateClientKey.pem

© 2015-2022 Devart. All Rights Reserved. Request Support ODBC Forum Provide Feedback