> ## Documentation Index
> Fetch the complete documentation index at: https://www.ravion.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# PostgreSQL SSL connection error: no pg_hba.conf entry

> Fix 'no pg_hba.conf entry for host ... SSL encryption' or 'no encryption' errors when an app connects to RDS for PostgreSQL, which requires TLS by default on version 15 and later.

Your app fails to connect to RDS with an error like one of these:

```text theme={null}
FATAL: no pg_hba.conf entry for host "10.0.12.34", user "myapp", database "myapp", no encryption
```

```text theme={null}
FATAL: no pg_hba.conf entry for host "10.0.12.34", user "myapp", database "myapp", SSL encryption
```

## Why this happens

RDS for PostgreSQL 15 and later ships with the `rds.force_ssl` parameter set to `1`, so the server rejects connections that do not negotiate TLS. Older major versions default to `0`, which is why an app that worked against Postgres 13 or 14 breaks after an upgrade or a fresh instance.

* **`no encryption`** in the message means the client connected without TLS. This is the common case.
* **`SSL encryption`** means TLS was negotiated and the rejection is about the user, database, or source: check the username and database in the connection string, and that the task's security group or CIDR is in the RDS module's `allowed_security_group_ids`/`allowed_cidr_blocks`. The TLS fixes below do not apply to this variant.

Both are client-side configuration problems, not network problems. If the app could not reach the instance at all you would see a connection timeout instead.

## Fix: require TLS in the connection string

For the `no encryption` variant, add `sslmode=require` to the connection URL, or the equivalent driver option:

```text theme={null}
postgresql://myapp:PASSWORD@myapp-production.xxxx.us-east-1.rds.amazonaws.com:5432/myapp?sslmode=require
```

<Tabs>
  <Tab title="Node (pg, Prisma, Drizzle)">
    `node-postgres` honours `sslmode=require` in the URL. Or in code:

    ```js theme={null}
    const pool = new Pool({
      connectionString: process.env.DATABASE_URL,
      ssl: {rejectUnauthorized: false},
    })
    ```

    Prisma: append `?sslmode=require` to `DATABASE_URL`. Drizzle: pass `ssl: "require"` to the driver.
  </Tab>

  <Tab title="Rails">
    ```yaml config/database.yml theme={null}
    production:
      url: <%= ENV["DATABASE_URL"] %>
      sslmode: require
    ```
  </Tab>

  <Tab title="Django">
    ```python theme={null}
    DATABASES["default"]["OPTIONS"] = {"sslmode": "require"}
    ```

    If you use `dj-database-url`, pass `ssl_require=True`.
  </Tab>

  <Tab title="Go (pgx)">
    `sslmode=require` in the URL is enough. pgx defaults to `prefer`, which negotiates TLS but falls back to plaintext — RDS then rejects the fallback.
  </Tab>
</Tabs>

`sslmode=require` encrypts the connection but does not verify the server certificate. That is acceptable inside a VPC, and it is what most managed platforms use.

## Fix: verify the server certificate

For `sslmode=verify-full`, the client needs the RDS certificate authority bundle. Download the global bundle from AWS and mount or bake it into the image:

```dockerfile theme={null}
ADD https://truststore.pki.rds.amazonaws.com/global/global-bundle.pem /etc/ssl/certs/rds-global-bundle.pem
```

```text theme={null}
postgresql://...?sslmode=verify-full&sslrootcert=/etc/ssl/certs/rds-global-bundle.pem
```

The `rvn-rds` module's `ca_cert_identifier` input selects which RDS CA signs the instance certificate; the global bundle covers all of them. See the [AWS documentation on SSL for RDS](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.SSL.html).

## Alternative: turn off the requirement

If a client cannot do TLS at all, set `rds.force_ssl` to `0` in the module's parameter group:

```yaml ravion.yaml theme={null}
parameters:
  - name: rds.force_ssl
    value: "0"
```

This weakens the security of traffic inside your VPC — prefer fixing the client.

## Related pages

* [`rvn-rds`](/docs/module-definitions/catalog/rvn-rds)
* [Migrate Heroku Postgres to RDS](/docs/migrate/heroku-postgres-to-rds)