# Ensure Database Connections Enforce SSL/TLS

- Source: https://support.icompaas.com/support/solutions/articles/ensure-database-connections-enforce-ssl-tls
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [DigitalOcean Cloud](https://support.icompaas.com/support/solutions/c_do_cloud) › [DigitalOcean Rules](https://support.icompaas.com/support/solutions/folders/digitalocean-rules)
- Last updated: 2026-08-13
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

Description:

DigitalOcean Managed Databases support encrypted connections using SSL/TLS. Database connections should require SSL/TLS encryption to protect credentials, queries, and data exchanged between applications and the database from interception or modification.

  

Rationale:

Unencrypted database connections can expose sensitive information to attackers who can intercept network traffic. Enforcing SSL/TLS provides confidentiality and helps protect database credentials and application data in transit.

  

Impact:

Clients that connect without SSL/TLS will be unable to connect once enforcement is enabled. All applications, scripts, and database clients must therefore be configured to use SSL/TLS.

  

Default Value:

SSL/TLS support is available for DigitalOcean Managed Databases. The exact enforcement behavior depends on the database engine and configuration. The database's SSL configuration should be explicitly verified rather than assuming that SSL support means SSL is mandatory.

  

Pre-Requisite:

1.  Log in to DigitalOcean with permission to view and modify database settings.
    
2.  Identify the Managed Databases that require encrypted connections.
    
3.  Verify that applications and database clients support SSL/TLS.
    
4.  Record the existing SSL configuration for backout.
    

  

Remediation:

Configure the Managed Database to require SSL/TLS connections and update all clients to connect using SSL/TLS certificates.

  

Test Plan:

Via DigitalOcean Control Panel

1.  Log in to the DigitalOcean Control Panel.
    
2.  Go to Databases.
    
3.  Select the Managed Database.
    
4.  Open Settings or Configuration.
    
5.  Review the database SSL/TLS configuration.
    
6.  Verify that SSL/TLS is enabled and, where supported by the database engine, configured to require encrypted connections.
    
7.  Verify the database connection details and CA certificate provided by DigitalOcean.
    

The check passes when database connections are required to use SSL/TLS.

  

CLI / API

List Managed Databases:

curl -s \\  
  -H "Authorization: Bearer $DIGITALOCEAN\_TOKEN" \\  -H "Content-Type: application/json" \\  "https://api.digitalocean.com/v2/databases" | jq

  

Retrieve a specific database:

curl -s \\  
  -H "Authorization: Bearer $DIGITALOCEAN\_TOKEN" \\  -H "Content-Type: application/json" \\  "https://api.digitalocean.com/v2/databases/<database\_id>" | jq

  

Review the database configuration for SSL/TLS-related settings.

For PostgreSQL, for example, the connection should use SSL:

psql "host=<host> port=<port> dbname=<database> user=<user> sslmode=require"

  

For MySQL:

mysql \\

  --host=<host> \\

  --port=<port> \\

  --user=<user> \\

  --password \\

  --ssl-mode=REQUIRED

  

Implementation:

Via DigitalOcean Control Panel

Note: By default, SSL/TLS enforcement is enabled by DigitalOcean

  

Backout Plan:

Note: By default, SSL/TLS enforcement is enabled by DigitalOcean

  

References:

-   [DigitalOcean — Managed Databases](https://docs.digitalocean.com/products/databases/)
    
-   [DigitalOcean — Managed Databases Connection Details](https://docs.digitalocean.com/products/databases/how-to/connect-to-postgresql/)
    
-   [DigitalOcean — PostgreSQL Connection Pooling and SSL](https://docs.digitalocean.com/products/databases/postgresql/how-to/connection-pooling/)
    
-   [DigitalOcean — MySQL Managed Databases](https://docs.digitalocean.com/products/databases/mysql/)
    
-   [DigitalOcean — Databases API Reference](https://docs.digitalocean.com/reference/api/reference/#tag/Databases)
    
-   [CIS Controls v8 — Network Infrastructure Management](https://www.cisecurity.org/controls/v8)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.