[agwa]

> Just use ?sslmode=require and a CA-issued certificate.

This is not secure. See Table 31-1 here:

https://www.postgresql.org/docs/9.5/static/libpq-ssl.html#LI...

As you can see, "require" provides no MitM protection. The only option among the six options that provides both eavesdropping and MitM protection under all scenarios is "verify-full".

Your misunderstanding is reasonable, and shows what can happen when software is insecure by default and has too many different security-sensitive options. I'll bet that very few Postgres users fully understand the nuances between the various sslmode options.

[merb]

he is not incorrect. if you are on a secure network you can stick with the default i.e. a aws network could be secure.

[agwa]

tajen advocated a CA-issued certificate along with the "require" option, which makes sense under no common scenario. If your network really is secure, you don't need TLS at all, so you can use "disable" and not bother with a cert. If your network isn't secure, then you need "verify-full" to actually have security.

[merb]

actually i just wanted to point that out. actually on aws you actually connect with ssl when you have an rds instance and using psql on a ec2 instance. however it will run with "prefer". which isn't really needed there.

[tinus_hn]

If you consider the Internet a secure network you can. Note that unless you connect to IP addresses you still need to do host name resolution which typically involves the Internet and if the Internet is considered insecure, may return answers controlled by an attacker..

I'd suggest avoiding shortcuts and using certificates.