Connect to DBHost with verify-full TLS

DBHost only accepts encrypted (TLS) connections. Certificate verification happens in your client, so set sslmode=verify-full: the client then checks that the server certificate is signed by a trusted CA and matches the host name. Weaker modes such as sslmode=require encrypt the connection but do not verify the server, so do not use them.

Endpoint	Use
`db.dbhost.app:6432`	Application traffic through PgBouncer
`migrate.dbhost.app:5432`	Short-lived direct migration access

The certificate is issued by Let’s Encrypt, a public CA. You do not need to download a DBHost-specific CA file. Point the client at the operating system’s trusted CA store instead.

psql and libpq

libpq 16 or newer accepts sslrootcert=system, which uses the system CA store:

psql -W "host=db.dbhost.app port=6432 dbname=YOUR_DATABASE user=YOUR_USERNAME sslmode=verify-full sslrootcert=system"

With an older libpq, set sslrootcert to your system CA bundle, for example /etc/ssl/certs/ca-certificates.crt on Debian and Ubuntu or /etc/ssl/cert.pem on macOS. pg_dump and pg_restore take the same connection parameters.

Node.js: pg, Prisma and Drizzle

node-postgres verifies the server against Node’s built-in CA list. Keep sslmode=verify-full in the connection string:

DATABASE_URL="postgresql://YOUR_USERNAME:PASSWORD@db.dbhost.app:6432/YOUR_DATABASE?sslmode=verify-full"

import { Pool } from "pg";

export const pool = new Pool({ connectionString: process.env.DATABASE_URL });

Prisma with @prisma/adapter-pg and Drizzle with drizzle-orm/node-postgres both use pg underneath, so the same URL works. Do not add rejectUnauthorized: false; that turns verification off.

Python: psycopg

psycopg 3 uses libpq. With libpq 16 or newer:

import os
import psycopg

conn = psycopg.connect(
    os.environ["DATABASE_URL"],
    sslmode="verify-full",
    sslrootcert="system",
)

Troubleshooting

certificate verify failed or unable to get local issuer certificate: the client cannot find a trusted CA store. Use sslrootcert=system with libpq 16+, or point sslrootcert at the system CA bundle.
server certificate does not match host name: connect with the exact host name shown in the dashboard, not an IP address.
sslrootcert=system rejected: your libpq is older than 16. Use a CA bundle path instead.

See Quickstart for connection details and Database roles to choose which login to use.

Getting Started

Trust & Security

Connect your app

Operate your database

Dashboard

Connect to DBHost with verify-full TLS

psql and libpq

Node.js: pg, Prisma and Drizzle

Python: psycopg

Troubleshooting

​psql and libpq

​Node.js: pg, Prisma and Drizzle

​Python: psycopg

​Troubleshooting

psql and libpq

Node.js: pg, Prisma and Drizzle

Python: psycopg

Troubleshooting