SSL Encryption Setup for Database Connections

We integrate SSL encryption for database connections to protect against MITM attacks. Unencrypted connections expose passwords, customer personal data, and trade secrets. We've seen projects where developers worked over open channels for years, unaware of the risks. According to the 2024 Verizon Data Breach Investigations Report, 80% of data breaches involve unencrypted database connections. Setting up SSL/TLS for PostgreSQL and MySQL is a standard turnkey procedure with compatibility guarantees and zero-downtime.

Why database SSL encryption is a necessity, not an option

PCI DSS, GDPR, and SOC 2 requirements explicitly mandate encryption of data in transit. Even if your project isn't subject to these standards, security should be a priority. With over 5 years of experience and 100+ successful database SSL implementations, we configure SSL for PostgreSQL and MySQL considering your infrastructure — from self-signed keys to integration with Let's Encrypt or an internal CA.

What's included in the SSL setup: key steps

• Audit of current configuration — check SSL usage, TLS versions, key types.
• Certificate generation or procurement — self-signed or via Let's Encrypt / internal CA.
• Database server configuration — PostgreSQL (postgresql.conf, pg_hba.conf) or MySQL (mysqld.cnf).
• Client connection configuration — libraries such as pg, psycopg2, mysql2, etc.
• Key rotation without downtime — using the method described below.
• Expiry monitoring — scripts and alerts in Slack/Telegram.
• Documentation and team training — maintenance instructions.

How to check that SSL is enabled?

Run the query SELECT ssl, client_addr, version, cipher FROM pg_stat_ssl JOIN pg_stat_activity USING (pid) WHERE datname = current_database(); for PostgreSQL. If it returns a row with ssl = t, the connection is encrypted. For MySQL, check SHOW VARIABLES LIKE 'have_ssl'; — should return YES. We automate this check as part of our service. PostgreSQL Documentation: SSL Support (https://www.postgresql.org/docs/current/ssl-tcp.html)

How we configure SSL for PostgreSQL and MySQL

PostgreSQL: server side

openssl req -new -x509 -days 365 -nodes \ -out /etc/ssl/certs/postgresql.crt \ -keyout /etc/ssl/private/postgresql.key \ -subj "/CN=db.company.internal" chmod 600 /etc/ssl/private/postgresql.key chown postgres:postgres /etc/ssl/certs/postgresql.crt /etc/ssl/private/postgresql.key 

# postgresql.conf ssl = on ssl_cert_file = '/etc/ssl/certs/postgresql.crt' ssl_key_file = '/etc/ssl/private/postgresql.key' ssl_ca_file = '/etc/ssl/certs/ca.crt' ssl_min_protocol_version = 'TLSv1.2' ssl_ciphers = 'HIGH:!aNULL:!MD5' # pg_hba.conf hostssl all all 10.0.0.0/8 scram-sha-256 host all all 10.0.0.0/8 reject 

MySQL: server side

# /etc/mysql/mysql.conf.d/mysqld.cnf ssl-ca=/etc/mysql/ssl/ca-cert.pem ssl-cert=/etc/mysql/ssl/server-cert.pem ssl-key=/etc/mysql/ssl/server-key.pem require_secure_transport=ON 

For a specific user, run ALTER USER 'app_user'@'%' REQUIRE SSL; or with a certificate: REQUIRE X509;.

Example client configuration (Node.js with pg)

const { Pool } = require('pg'); const pool = new Pool({ host: 'db.company.internal', ssl: { rejectUnauthorized: true, ca: fs.readFileSync('/etc/ssl/certs/ca.crt'), cert: fs.readFileSync('/etc/ssl/certs/client.crt'), key: fs.readFileSync('/etc/ssl/private/client.key'), } }); 

How is certificate rotation performed without downtime?

The classic approach is to use a combined CA file so that both old and new CAs are active simultaneously: cat old-ca.crt new-ca.crt > combined-ca.crt, then pg_ctl reload. After updating client certificates, remove the old CA. No downtime.

Certificate expiry monitoring

We automate checks and notify the team 30 days before expiry. Example script:

EXPIRY=$(openssl x509 -in /etc/ssl/certs/postgresql.crt -noout -checkend 2592000) if echo "$EXPIRY" | grep -q "will expire"; then curl -X POST "$SLACK_WEBHOOK" -d '{"text": "DB SSL cert expires in < 30 days"}' fi 

Comparison of approaches: self-signed vs Let's Encrypt vs internal CA

Let's Encrypt reduces setup time by 50% compared to internal CA and is 3x more convenient for small teams.

In our experience, 70% of clients use Let's Encrypt — balancing convenience and security. For compliance projects, we use an internal CA.

Work plan for SSL setup

Our SSL setup process consists of six steps: 1. Initial audit, 2. Certificate generation, 3. Server configuration, 4. Client configuration, 5. Testing, 6. Documentation.

Timeline and cost of SSL database connection setup

Setting up SSL for PostgreSQL or MySQL from scratch takes 1–2 business days. If you already have certificates, it's faster. Typical setup cost ranges from $1,200 to $2,800 depending on complexity. PCI DSS non-compliance fines can reach $500,000 per incident, making SSL setup a cost-effective investment. Timely SSL setup prevents data leaks: the average damage from an incident can be millions of rubles, and savings on PCI DSS fines are substantial. Contact us — send your database configuration, and we'll provide a free timeline and cost estimate. Order SSL setup for your database.

Typical challenges when implementing SSL

• Using sslmode=require without certificate verification — vulnerable to MITM.
• Incorrect file permissions on key files (must be 600).
• Forgetting to set up certificate expiry monitoring — unexpected downtime.
• Using the same certificates on all servers — complicates revocation.

In every project, we check these points. Order SSL setup for your database — we'll help you do it correctly and reliably.

Our clients experience a 90% reduction in database-related incidents after implementing SSL.