Provide SSL certificate to PostgreSQL in a Rails app

Question

I have a Rails app on Elastic Beanstalk using an Amazon RDS PostgreSQL instance.

I'd like pg to use SSL to connect to this DB.

Following http://docs.aws.amazon.com/AmazonRDS/[...], I saved rds-combined-ca-bundle.pem at /config/ca/rds.pem and my database.yml looks like this:

production:
  adapter: postgresql
  database: <%= ENV['DB_NAME'] %>
  username: <%= ENV['DB_USERNAME'] %>
  password: <%= ENV['DB_PASSWORD'] %>
  host: <%= ENV['DB_ADDRESS'] %>
  port: <%= ENV['DB_PORT'] %>
  sslmode: 'require'
  sslrootcert: 'config/ca/rds.pem'

But I have no idea if it's really using SSL: I can change sslrootcert path to anything, and my app is still up. What am I missing?

I see that you are pointing to pem file, and I also see some articles referring to file of extension crt (like in this answer: stackoverflow.com/questions/31355047/… ) , what's the difference between them? did they both work for you? — simo

PJ Bergeron PJ Bergeron · Accepted Answer · 2015-02-26T06:53:16

In your database.yml you have to use sslmode: 'verify-full' instead of sslmode: 'require' in order to verify the instance endpoint against the endpoint in the SSL certificate. This way the certificate is used.

Provide SSL certificate to PostgreSQL in a Rails app

1 Answers