PG_AUTOCTL ENABLE SSL(1)

💖 PG_AUTOCTL ENABLE SSL(1) 💖

okay bestie, gather round, because this is the pg_autoctl enable ssl page from the pg_auto_failover manual and it's literally about making your Postgres talk over the network with encryption on. no cap.

---

✨ NAME ✨

pg_autoctl enable ssl — like, the command itself

pg_autoctl enable ssl — turn on SSL config for this node, periodt

---

🌸 SYNOPSIS 🌸

so the way this works is you can manage Postgres SSL settings with the pg_autoctl command — both at pg_autoctl create postgres time, and then again later if you change your mind and want to update the SSL settings at run-time. main character energy: you get to decide twice. 💅

     usage: pg_autoctl enable ssl  [ --pgdata ] [ --json ]

    --pgdata      path to data directory
    --ssl-self-signed setup network encryption using self signed certificates (does NOT protect against MITM)
    --ssl-mode        use that sslmode in connection strings
    --ssl-ca-file     set the Postgres ssl_ca_file to that file path
    --ssl-crl-file    set the Postgres ssl_crl_file to that file path
    --no-ssl          don't enable network encryption (NOT recommended, prefer --ssl-self-signed)
    --server-key      set the Postgres ssl_key_file to that file path
    --server-cert     set the Postgres ssl_cert_file to that file path

---

🎀 OPTIONS 🎀

• --pgdata — where the Postgres node you're managing locally keeps its data. it defaults to the environment variable PGDATA. and heads up: use --monitor if you wanna connect to a monitor from literally anywhere, instead of the monitor URI that a local Postgres node managed with pg_autoctl uses. iykyk 🦋
• --ssl-self-signed — generate SSL self-signed certificates so you get network encryption. it does NOT protect against man-in-the-middle kinds of attacks, bestie, be so for real about that. see Security settings for pg_auto_failover for more about our SSL settings. 🔥
• --ssl-mode — the SSL Mode that pg_autoctl uses when it connects to other nodes, including when it's connecting for streaming replication. 👑
• --ssl-ca-file — set the Postgres ssl_ca_file to that file path. 🌸
• --ssl-crl-file — set the Postgres ssl_crl_file to that file path. 🌸
• --no-ssl — don't enable network encryption. this is not recommended, prefer --ssl-self-signed. like, genuinely, prefer it. 😭
• --server-key — set the Postgres ssl_key_file to that file path. 🔑
• --server-cert — set the Postgres ssl_cert_file to that file path. 📜

---

🌈 ENVIRONMENT 🌈

• PGDATA — Postgres directory location. you can use this instead of the --pgdata option. 🫶
• PG_AUTOCTL_MONITOR — Postgres URI for connecting to the monitor node, can be used instead of the --monitor option. ✨
• XDG_CONFIG_HOME — the pg_autoctl command stores its configuration files in the standard place XDG_CONFIG_HOME. see the XDG Base Directory Specification. 🎀
• XDG_DATA_HOME — the pg_autoctl command stores its internal states files in the standard place XDG_DATA_HOME, which defaults to ~/.local/share. see the XDG Base Directory Specification. 🦋

---

👑 AUTHOR 👑

Microsoft 💜

---

⭐ COPYRIGHT ⭐

Copyright (c) Microsoft Corporation. All rights reserved.

---

and that's the whole page, bestie — you ate that 💅✨

okay so this was version 2.2, dated Apr 07, 2025, from the PG_AUTOCTL ENABLE SSL(1) of the pg_auto_failover manual. love u, go encrypt something 🫶💖🌸