Skip to content

Commit 8379b1e

Browse files
Docs around SSL support for RDS (#635)
Co-authored-by: Mathieu Cloutier <79954947+cloutierMat@users.noreply.github.com>
1 parent b4cf8e7 commit 8379b1e

1 file changed

Lines changed: 26 additions & 0 deletions

File tree

  • src/content/docs/aws/services

src/content/docs/aws/services/rds.mdx

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -295,6 +295,32 @@ You can now connect to the database utilizing the user you generated and the tok
295295
PGPASSWORD=$TOKEN psql -d $DB_NAME -U myiam -w -p $PORT -h $HOST
296296
```
297297

298+
## SSL/TLS Support
299+
300+
LocalStack's RDS PostgreSQL emulation supports SSL/TLS-encrypted client connections, so you can test applications that require `sslmode=require`.
301+
SSL/TLS support is currently available for the `postgres` engine.
302+
303+
### Connect using SSL
304+
305+
Once your DB instance is running, request an encrypted connection from any PostgreSQL client by passing the `sslmode` parameter.
306+
With `psql`:
307+
308+
```bash
309+
PGPASSWORD=$MASTER_PW psql "host=$HOST port=$PORT dbname=$DB_NAME user=$MASTER_USER sslmode=require"
310+
```
311+
312+
Certificate verification with `sslmode=verify-ca` or `sslmode=verify-full` is not currently supported.
313+
314+
### Limitations
315+
316+
LocalStack currently enables SSL/TLS connections for PostgreSQL DB instances, but does not enforce SSL-only connections.
317+
The `rds.force_ssl` parameter is accepted for compatibility, but it is not enforced.
318+
Clients can still connect without SSL.
319+
320+
:::note
321+
The PostgreSQL `pg_stat_ssl` view always reports `ssl = false`, even when the client connection is encrypted.
322+
:::
323+
298324
## Global Database Support
299325

300326
LocalStack extends support for [Aurora Global Database](https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/aurora-global-database.html) with certain limitations:

0 commit comments

Comments
 (0)