PG_AUTOCTL_ENABLE_SSL(1)

💖 PG_AUTOCTL ENABLE SSL 💖

okay bestie, this is the pg_autoctl enable ssl page from the pg_auto_failover manual, section 1. it's giving "let's talk about network encryption" energy and honestly? we love that for us. 🦋

---

✨ NAME ✨

pg_autoctl enable ssl — pg_autoctl enable ssl

pg_autoctl enable ssl — Enable SSL configuration on this node

---

🌸 SYNOPSIS 🌸

so here's the thing, bestie: you can manage your Postgres SSL settings with the pg_autoctl command. both at pg_autoctl create postgres time, and then again later when you change your mind and want to update those SSL settings at run-time. iconic, flexible, we stan. 💅

usage: pg_autoctl enable ssl  [ --pgdata ] [ --json ]

--pgdata      path to data directory
--ssl-self-signed setup network encryption using self signed certificates (does NOT protect against MITM)
--ssl-mode        use that sslmode in connection strings
--ssl-ca-file     set the Postgres ssl_ca_file to that file path
--ssl-crl-file    set the Postgres ssl_crl_file to that file path
--no-ssl          don't enable network encryption (NOT recommended, prefer --ssl-self-signed)
--server-key      set the Postgres ssl_key_file to that file path
--server-cert     set the Postgres ssl_cert_file to that file path

---

👑 OPTIONS 👑

every single one of these, no skips, fr fr:

• --pgdata — where the Postgres node that's being managed locally lives. defaults to the PGDATA environment variable. and ooh, use --monitor if you wanna connect to a monitor from anywhere, instead of the monitor URI that a local Postgres node managed with pg_autoctl is using. 💫
• --ssl-self-signed — generate SSL self-signed certificates so you get network encryption. 🎀 heads up though: this does NOT protect against man-in-the-middle kinds of attacks. check out "Security settings for pg_auto_failover" for more about the SSL settings.
• --ssl-mode — the SSL Mode pg_autoctl uses when it's connecting to other nodes, including when it's connecting for streaming replication. 🦋
• --ssl-ca-file — sets the Postgres ssl_ca_file to that file path.
• --ssl-crl-file — sets the Postgres ssl_crl_file to that file path.
• --no-ssl — don't enable network encryption. not recommended, bestie!! prefer --ssl-self-signed. 🙈
• --server-key — sets the Postgres ssl_key_file to that file path.
• --server-cert — sets the Postgres ssl_cert_file to that file path.

---

🌈 ENVIRONMENT 🌈

• PGDATA — Postgres directory location. can be used instead of the --pgdata option. 💜
• PG_AUTOCTL_MONITOR — Postgres URI to connect to the monitor node, can be used instead of the --monitor option. 💜
• XDG_CONFIG_HOME — the pg_autoctl command stores its configuration files in the standard place XDG_CONFIG_HOME. see the XDG Base Directory Specification.
• XDG_DATA_HOME — the pg_autoctl command stores its internal states files in the standard place XDG_DATA_HOME, which defaults to ~/.local/share. see the XDG Base Directory Specification.

---

💖 AUTHOR 💖

Microsoft

---

⭐ COPYRIGHT ⭐

Copyright (c) Microsoft Corporation. All rights reserved.

---

and that's the whole page, bestie!! go forth and enable that SSL, you absolute icon 👑✨

this was version 2.1, dated Jan 18, 2025, from the pg_auto_failover manual, section 1 — mwah, take care of your certs, love u, bye!! 🫶🌸