# Ensure 'Enforce SSL connection' is set to 'ENABLED' for PostgreSQL Database Server

- Source: https://support.icompaas.com/support/solutions/articles/62000219847-ensure-enforce-ssl-connection-is-set-to-enabled-for-postgresql-database-server
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Azure CIS Benchmark Level 1 & Level 2](https://support.icompaas.com/support/solutions/62000112163) › [4. Database Services](https://support.icompaas.com/support/solutions/folders/62000167547)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

Description:

Azure Database for PostgreSQL supports encrypted connections using SSL or TLS. Enabling Enforce SSL Connection ensures that all client traffic to the PostgreSQL server is encrypted and protects data in transit. When this setting is enabled, insecure non-SSL connections are blocked, preventing exposure of credentials, queries, and sensitive data. This control checks whether Enforce SSL Connection is configured as Enabled on the PostgreSQL server.

  

Rationale:

If SSL enforcement is disabled, database connections may occur over plaintext, exposing data to interception and allowing potential man-in-the-middle attacks. This may violate compliance standards such as CIS, PCI, NIST, and ISO. Enforcing SSL ensures secure communication, protects authentication information, and reduces the risk of network-based attacks.

  

Impact:

-   Ensures all data-in-transit is encrypted
    
-   Prevents plaintext authentication and query traffic
    
-   Strengthens compliance posture
    
-   Protects against MITM and eavesdropping attacks
    

  

Default Value:

Enforce SSL Connection is enabled by default for Azure Database for PostgreSQL, but it can be manually disabled.

  

Pre-Requisites:

-   Access to PostgreSQL Server configuration
    
-   Permissions:
    
    -   Microsoft.DBforPostgreSQL/servers/read
        
    -   Microsoft.DBforPostgreSQL/servers/write
        

  

Test Plan :

1.  Sign in to the Azure Portal at [https://portal.azure.com](https://portal.azure.com/)
    
2.  Search for and open Azure Database for PostgreSQL – Flexible Server
    
3.  Select the target PostgreSQL server
    
4.  From the left menu, under settings, select Server parameters
    
5.  Search for the parameter require\_secure\_transport
    
6.  Verify require\_secure\_transport is set to ON
    
7.  Confirm that SSL/TLS is enforced for all client connections
    
8.  If require\_secure\_transport is not set to ON, follow the implementation steps
    

![](https://support.icompaas.com/assets/kb/4080734dbeab00cf.png)

  

Implementation Steps :

1.  Sign in to the Azure Portal at [https://portal.azure.com](https://portal.azure.com/)
    
2.  Search for and open the PostgreSQL Flexible Server
    

![](https://support.icompaas.com/assets/kb/5377e67a5d5b56e0.png)

3.  From the left menu, under settings, select Server parameters
    

                          ![](https://support.icompaas.com/assets/kb/b1e76916c99b1bdb.png)

4.  Search for the parameter require\_secure\_transport
    
5.  Set require\_secure\_transport to ON
    

![](https://support.icompaas.com/assets/kb/47a9d374db560f7e.png)

6.  Click Save to apply the changes
    

Backout Plan:

1.  Sign in to the Azure Portal at [https://portal.azure.com](https://portal.azure.com/)
    
2.  Open Azure Database for PostgreSQL Flexible Server
    
3.  Select the target PostgreSQL server
    
4.  Navigate to Server parameters
    
5.  Locate require\_secure\_transport
    
6.  Set require\_secure\_transport to OFF
    
7.  Click Save to revert the change
    

  

Reference:

-   [https://learn.microsoft.com/azure/postgresql/concepts-ssl-connection-security](https://learn.microsoft.com/azure/postgresql/concepts-ssl-connection-security)
    
-   [https://learn.microsoft.com/cli/azure/postgres/server](https://learn.microsoft.com/azure/postgresql/concepts-ssl-connection-security)
    
-   [https://learn.microsoft.com/powershell/module/az.postgresql](https://learn.microsoft.com/azure/postgresql/concepts-ssl-connection-security)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.