Use SSL verify-full with RDS PostgreSQL on Mac

Ghazi · July 30, 2026

Amazon RDS for PostgreSQL supports encrypted connections, but sslmode=require only requires encryption in libpq. verify-full also validates the certificate chain and confirms that the hostname matches the RDS certificate.

Download AWS's current global CA bundle, store it at ~/.postgresql/root.crt, and connect to the exact RDS endpoint with sslmode=verify-full. PostgresGUI can verify certificates from the system trust store, but it does not currently load a custom sslrootcert file from the URI, so use psql for this custom-CA workflow.

PostgresGUI connection form with PostgreSQL SSL settings
PostgresGUI exposes SSL modes for ordinary trusted certificates. The custom AWS CA-file workflow below uses libpq and psql.

Install the current AWS RDS CA bundle

mkdir -p ~/.postgresql
curl --fail --location   "https://truststore.pki.rds.amazonaws.com/global/global-bundle.pem"   --output ~/.postgresql/root.crt
chmod 644 ~/.postgresql/root.crt

AWS documents the global bundle for commercial regions. Use the region-specific bundle when your policy requires it.

Connect with hostname verification

psql "host=INSTANCE.abcdefg.us-east-1.rds.amazonaws.com port=5432 dbname=DB_NAME user=DB_USER sslmode=verify-full sslrootcert=$HOME/.postgresql/root.crt"

Copy the endpoint, not an IP address

Open the RDS database in AWS and copy the endpoint from Connectivity & security. Certificate hostname verification is performed against that name.

An IP address does not provide the expected RDS hostname. A custom DNS alias can also fail unless its name is present in the certificate.

What verify-full changes

A libpq client defaults to sslmode=prefer, which can fall back to an unencrypted connection. require prevents that fallback but does not perform complete server identity verification without trusted roots.

verify-full requires TLS, validates the chain to the configured AWS root, and checks the requested hostname. That is the setting to use when server identity matters.

Verify the active session

Once psql connects, use \conninfo for a quick TLS summary, then query pg_stat_ssl for values PostgreSQL reports about the current backend.

TLS check

\conninfo

select ssl, version, cipher, bits
from pg_stat_ssl
where pid = pg_backend_pid();

ssl should be true. The version and cipher depend on the negotiated connection.

Fix certificate errors without weakening verification

Do not solve a certificate error by silently switching to disable or prefer. Check the endpoint and root file first.

  • No such file: verify the sslrootcert path and expand $HOME in the shell, not inside a single-quoted URI.
  • Certificate verify failed: download the current AWS bundle again and confirm the instance CA in RDS.
  • Hostname mismatch: use the exact RDS endpoint, not an IP address or unrelated alias.
  • Timeout: check the security group, route, VPN, public-access setting, or bastion before changing TLS.

Use a tunnel for private RDS instances

A private RDS instance should stay private. Reach it through a VPN or bastion instead of opening port 5432 to the internet. The PostgreSQL SSH tunnel guide covers both the shell and PostgresGUI tunnel paths.

For certificates already trusted by macOS, PostgresGUI's Verify Full mode checks the chain and hostname. Review the Mac client features before choosing the connection method.