# Ensure SSL/TLS is enforced for all Postgres connections

- Source: https://support.icompaas.com/support/solutions/articles/a_1790103902784900-ensure-ssltls-is-enforced-for-all-postgres-connections
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Supabase cloud](https://support.icompaas.com/support/solutions/c_1790103054038308) › [supabase checks](https://support.icompaas.com/support/solutions/folders/f_1790103067540538)
- Last updated: 2026-09-22
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure the Enforce SSL on incoming connections setting is enabled, so that all connections to Postgres, Supavisor, and the dedicated pooler must use SSL/TLS encryption. Clients should also connect using sslmode=verify-full with the Supabase CA certificate for the strongest protection.

**Rationale**

Without SSL enforcement, clients can connect to the database without encryption, sending passwords and data in plain text across the network. Attackers on the network path could read or change this traffic. Enforcing SSL makes sure every database connection is encrypted. Supabase's HTTP APIs already enforce SSL, but direct database connections do not by default.

**Impact**

-   All database connections must use SSL
    
-   Clients that do not use SSL can no longer connect
    
-   Changing the setting causes a short database restart
    

**Default Value**

By default, SSL is not enforced for direct Postgres and pooler connections, to keep compatibility with older clients.

**Pre-Requisites**

-   Project Owner or Admin role
    
-   All database clients able to connect using SSL
    
-   A short maintenance window
    

**Test Plan**

1.  Sign in to the Supabase Dashboard at [https://supabase.com/dashboard](https://supabase.com/dashboard).
    
2.  Select your project.
    
3.  Open Database in the sidebar and select Settings.
    
4.  In the SSL Configuration section, verify that Enforce SSL on incoming connections is enabled.
    
5.  If it is disabled, follow the implementation steps.
    

**Implementation Steps**

1.  Sign in to the Supabase Dashboard at [https://supabase.com/dashboard](https://supabase.com/dashboard).
    
2.  Select your project.
    
3.  Open Database in the sidebar and select Settings.
    
4.  In the SSL Configuration section, enable Enforce SSL on incoming connections and confirm.
    
5.  Download the CA certificate from the same section and configure clients to use sslmode=verify-full.
    

**Backout Plan**

1.  Sign in to the Supabase Dashboard at [https://supabase.com/dashboard](https://supabase.com/dashboard).
    
2.  Select your project.
    
3.  Open Database in the sidebar and select Settings.
    
4.  In the SSL Configuration section, disable Enforce SSL on incoming connections and confirm.
    

**Reference**

-   [https://supabase.com/docs/guides/platform/ssl-enforcement](https://supabase.com/docs/guides/platform/ssl-enforcement)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.