Description

Ensure connection strings that services use to connect to Render Postgres over the private network include sslmode=require. Render supports TLS on internal connections, using self-signed certificates, but does not require it, so clients may fall back to plaintext.

Rationale

Without sslmode=require, internal database traffic, including passwords and query results, can travel unencrypted across the private network. Requiring TLS makes sure the connection is always encrypted and stops the client from silently falling back to plaintext.

Impact

  • Internal database traffic is always encrypted

  • Prevents plaintext fallback

  • verify-ca and verify-full cannot be used on internal connections

Default Value

Internal connections optionally support TLS but do not require it. External connections are always encrypted.

Pre-Requisites

  • Admin or Developer role on the connecting services

Remediation

Test Plan

  1. Sign in to the Render Dashboard at https://dashboard.render.com.

  2. Open each service that connects to the database and review its database connection string on the Environment page (or in its linked environment group).

  3. If an internal connection string does not include sslmode=require, follow the implementation steps.

Implementation Steps

  1. Sign in to the Render Dashboard at https://dashboard.render.com.

  2. Open the service's Environment page (or the linked environment group).

  3. Add ?sslmode=require to the internal connection URL, for example postgresql://USER:PASSWORD@INTERNAL_HOST:5432/DATABASE?sslmode=require (use &sslmode=require if the URL already has parameters).

  4. Save the changes and redeploy the service if it does not redeploy automatically.

Backout Plan

  1. Sign in to the Render Dashboard at https://dashboard.render.com.

  2. Remove sslmode=require from the connection string and save.

Reference