Description
Ensure the Enforce SSL on incoming connections setting is enabled, so that all connections to Postgres, Supavisor, and the dedicated pooler must use SSL/TLS encryption. Clients should also connect using sslmode=verify-full with the Supabase CA certificate for the strongest protection.
Rationale
Without SSL enforcement, clients can connect to the database without encryption, sending passwords and data in plain text across the network. Attackers on the network path could read or change this traffic. Enforcing SSL makes sure every database connection is encrypted. Supabase's HTTP APIs already enforce SSL, but direct database connections do not by default.
Impact
All database connections must use SSL
Clients that do not use SSL can no longer connect
Changing the setting causes a short database restart
Default Value
By default, SSL is not enforced for direct Postgres and pooler connections, to keep compatibility with older clients.
Pre-Requisites
Project Owner or Admin role
All database clients able to connect using SSL
A short maintenance window
Test Plan
Sign in to the Supabase Dashboard at https://supabase.com/dashboard.
Select your project.
Open Database in the sidebar and select Settings.
In the SSL Configuration section, verify that Enforce SSL on incoming connections is enabled.
If it is disabled, follow the implementation steps.
Implementation Steps
Sign in to the Supabase Dashboard at https://supabase.com/dashboard.
Select your project.
Open Database in the sidebar and select Settings.
In the SSL Configuration section, enable Enforce SSL on incoming connections and confirm.
Download the CA certificate from the same section and configure clients to use sslmode=verify-full.
Backout Plan
Sign in to the Supabase Dashboard at https://supabase.com/dashboard.
Select your project.
Open Database in the sidebar and select Settings.
In the SSL Configuration section, disable Enforce SSL on incoming connections and confirm.
Reference