ssl
No restart — takes effect on reloadboolean (on/off)
Enables TLS for client connections.
What it does
With ssl on, and ssl_cert_file / ssl_key_file pointing at a valid certificate and key, PostgreSQL offers TLS to clients that request it. Whether TLS is required is enforced separately by pg_hba.conf ('hostssl' vs 'host').
How to tune it
Enable TLS for any non-loopback access. Use a real certificate (Let's Encrypt or your CA — not a self-signed one in production). To actually require TLS, use 'hostssl' lines in pg_hba.conf so the client can't fall back to plaintext.
FAQ
- Is setting ssl = on enough to enforce TLS?
- No. ssl = on only enables it as an option. To require TLS, set up pg_hba.conf 'hostssl' entries — that's what makes the server refuse plaintext connections from a given host/user.