# Ensure internal Postgres connections require TLS

- Source: https://support.icompaas.com/support/solutions/articles/a_1793876668870504-ensure-internal-postgres-connections-require-tls
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Render Cloud](https://support.icompaas.com/support/solutions/c_1793875953948152) › [Checks](https://support.icompaas.com/support/solutions/folders/f_1793875960840493)
- Last updated: 2026-11-05
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure connection strings that services use to connect to Render Postgres over the private network include sslmode=require. Render supports TLS on internal connections, using self-signed certificates, but does not require it, so clients may fall back to plaintext.

**Rationale**

Without sslmode=require, internal database traffic, including passwords and query results, can travel unencrypted across the private network. Requiring TLS makes sure the connection is always encrypted and stops the client from silently falling back to plaintext.

**Impact**

-   Internal database traffic is always encrypted
    
-   Prevents plaintext fallback
    
-   verify-ca and verify-full cannot be used on internal connections
    

**Default Value**

Internal connections optionally support TLS but do not require it. External connections are always encrypted.

**Pre-Requisites**

-   Admin or Developer role on the connecting services
    

**Remediation**

**Test Plan**

1.  Sign in to the Render Dashboard at [https://dashboard.render.com](https://dashboard.render.com/).
    
2.  Open each service that connects to the database and review its database connection string on the Environment page (or in its linked environment group).
    
3.  If an internal connection string does not include sslmode=require, follow the implementation steps.
    

**Implementation Steps**

1.  Sign in to the Render Dashboard at [https://dashboard.render.com](https://dashboard.render.com/).
    
2.  Open the service's Environment page (or the linked environment group).
    
3.  Add ?sslmode=require to the internal connection URL, for example postgresql://USER:PASSWORD@INTERNAL\_HOST:5432/DATABASE?sslmode=require (use &sslmode=require if the URL already has parameters).
    
4.  Save the changes and redeploy the service if it does not redeploy automatically.
    

**Backout Plan**

1.  Sign in to the Render Dashboard at [https://dashboard.render.com](https://dashboard.render.com/).
    
2.  Remove sslmode=require from the connection string and save.
    

**Reference**

-   [https://render.com/docs/postgresql-creating-connecting](https://render.com/docs/postgresql-creating-connecting)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.