Skip to main content

Database SSL

Database SSL encrypts the communication between your applications and databases, ensuring that data remains secure. With automatic certificate binding and generation, this feature simplifies secure setup.

1. How to Enable Database SSL​

To secure your database connection with SSL:

  1. Access Database Settings — In your dashboard, access the general settings of the database you want to secure.
  2. Enable SSL Mode — Check the Enable SSL option to activate SSL for the database connection.
  3. Select the SSL Mode — Choose the SSL mode from the dropdown menu. For example, select verify-full for maximum security.
Note

To make use of SSL after enabling it, you need to use the new connection URL for your app, which includes the SSL configuration. If you are not using the new URL, the database connection will not use SSL (in most cases).

2. SSL Modes Explained​

PostgreSQL​

  • allow (insecure) — Permits both encrypted and unencrypted connections. Not recommended.
  • prefer (secure) — Attempts SSL first, falls back to unencrypted if unavailable.
  • require (secure) — Mandates encrypted connection but does not verify the server certificate.
  • verify-ca (secure) — Encrypts and verifies the server certificate is signed by a trusted CA.
  • verify-full (secure) — Most secure. Encrypts, verifies CA, and confirms hostname matches the certificate.

Other Databases​

  • MySQL & MongoDB: Only prefer, require, verify-ca, and verify-full are available.
  • MariaDB, Redis, KeyDB, DragonFly DB: No SSL modes visible in the UI.
  • ClickHouse DB: SSL is not supported.
Developer Note

Modes lower than require are not 100% secure as they only encrypt the connection without full verification.

For modes higher than require (verify-ca and verify-full), you must mount the CA certificate into the container that connects to the database.

tip

For maximum security, verify-full is recommended when available.

3. CA SSL Certificate Management​

The platform manages the CA certificate automatically. In the dashboard, under Servers > YOUR_SERVER_NAME > Proxy > Advanced, you can:

  • View the current CA certificate
  • Save a local copy
  • Regenerate the certificate

Mount the CA certificate into all containers that need to connect to your databases:

/data/coolify/ssl/coolify-ca.crt:/etc/ssl/certs/coolify-ca.crt:ro

4. Using a Custom CA Certificate​

To use your own CA certificate:

  1. Prepare your certificate in PEM format.
  2. Upload it to /data/coolify/ssl/coolify-ca.crt.
  3. Mount the certificate in containers that need database access:
/data/coolify/ssl/coolify-ca.crt:/etc/ssl/certs/coolify-ca.crt:ro