PostgreSQL SSL connection error: no pg_hba.conf entry

Your app fails to connect to RDS with an error like one of these:

FATAL: no pg_hba.conf entry for host "10.0.12.34", user "myapp", database "myapp", no encryption

FATAL: no pg_hba.conf entry for host "10.0.12.34", user "myapp", database "myapp", SSL encryption

Why this happens

RDS for PostgreSQL 15 and later ships with the rds.force_ssl parameter set to 1, so the server rejects connections that do not negotiate TLS. Older major versions default to 0, which is why an app that worked against Postgres 13 or 14 breaks after an upgrade or a fresh instance.

no encryption in the message means the client connected without TLS. This is the common case.
SSL encryption means TLS was negotiated and the rejection is about the user, database, or source: check the username and database in the connection string, and that the task’s security group or CIDR is in the RDS module’s allowed_security_group_ids/allowed_cidr_blocks. The TLS fixes below do not apply to this variant.

Both are client-side configuration problems, not network problems. If the app could not reach the instance at all you would see a connection timeout instead.

Fix: require TLS in the connection string

For the no encryption variant, add sslmode=require to the connection URL, or the equivalent driver option:

postgresql://myapp:PASSWORD@myapp-production.xxxx.us-east-1.rds.amazonaws.com:5432/myapp?sslmode=require

Node (pg, Prisma, Drizzle)
Rails
Django
Go (pgx)

node-postgres honours sslmode=require in the URL. Or in code:

const pool = new Pool({
  connectionString: process.env.DATABASE_URL,
  ssl: {rejectUnauthorized: false},
})

Prisma: append ?sslmode=require to DATABASE_URL. Drizzle: pass ssl: "require" to the driver.

config/database.yml

production:
  url: <%= ENV["DATABASE_URL"] %>
  sslmode: require

DATABASES["default"]["OPTIONS"] = {"sslmode": "require"}

If you use dj-database-url, pass ssl_require=True.

sslmode=require in the URL is enough. pgx defaults to prefer, which negotiates TLS but falls back to plaintext — RDS then rejects the fallback.

sslmode=require encrypts the connection but does not verify the server certificate. That is acceptable inside a VPC, and it is what most managed platforms use.

Fix: verify the server certificate

For sslmode=verify-full, the client needs the RDS certificate authority bundle. Download the global bundle from AWS and mount or bake it into the image:

ADD https://truststore.pki.rds.amazonaws.com/global/global-bundle.pem /etc/ssl/certs/rds-global-bundle.pem

postgresql://...?sslmode=verify-full&sslrootcert=/etc/ssl/certs/rds-global-bundle.pem

The rvn-rds module’s ca_cert_identifier input selects which RDS CA signs the instance certificate; the global bundle covers all of them. See the AWS documentation on SSL for RDS.

Alternative: turn off the requirement

If a client cannot do TLS at all, set rds.force_ssl to 0 in the module’s parameter group:

ravion.yaml

parameters:
  - name: rds.force_ssl
    value: "0"

This weakens the security of traffic inside your VPC — prefer fixing the client.

Introduction

Concepts

Config as code

Migrate

Modules

Pipelines

Guides

Troubleshooting

Agent setup

Module definitions

PostgreSQL SSL connection error: no pg_hba.conf entry

Why this happens

Fix: require TLS in the connection string

Fix: verify the server certificate

Alternative: turn off the requirement

​Why this happens

​Fix: require TLS in the connection string

​Fix: verify the server certificate

​Alternative: turn off the requirement

​Related pages

Why this happens

Fix: require TLS in the connection string

Fix: verify the server certificate

Alternative: turn off the requirement

Related pages