> ## Documentation Index
> Fetch the complete documentation index at: https://docs.dbhost.app/llms.txt
> Use this file to discover all available pages before exploring further.

# Connect to DBHost with verify-full TLS

> DBHost requires TLS; use sslmode=verify-full. Set up certificate verification for psql, node-postgres, Prisma, Drizzle and psycopg with a public CA.

DBHost only accepts encrypted (TLS) connections. Certificate verification
happens in your client, so set `sslmode=verify-full`: the client then checks
that the server certificate is signed by a trusted CA and matches the host
name. Weaker modes such as `sslmode=require` encrypt the connection but do not
verify the server, so do not use them.

| Endpoint | Use |
| - | - |
| `db.dbhost.app:6432` | Application traffic through PgBouncer |
| `migrate.dbhost.app:5432` | Short-lived [direct migration access](/guides/direct-migrations) |

The certificate is issued by Let's Encrypt, a public CA. You do not need to
download a DBHost-specific CA file. Point the client at the operating system's
trusted CA store instead.

## psql and libpq

libpq 16 or newer accepts `sslrootcert=system`, which uses the system CA store:

```bash theme={null}
psql -W "host=db.dbhost.app port=6432 dbname=YOUR_DATABASE user=YOUR_USERNAME sslmode=verify-full sslrootcert=system"
```

With an older libpq, set `sslrootcert` to your system CA bundle, for example
`/etc/ssl/certs/ca-certificates.crt` on Debian and Ubuntu or `/etc/ssl/cert.pem`
on macOS. `pg_dump` and `pg_restore` take the same connection parameters.

## Node.js: pg, Prisma and Drizzle

node-postgres verifies the server against Node's built-in CA list. Keep
`sslmode=verify-full` in the connection string:

```bash theme={null}
DATABASE_URL="postgresql://YOUR_USERNAME:PASSWORD@db.dbhost.app:6432/YOUR_DATABASE?sslmode=verify-full"
```

```ts theme={null}
import { Pool } from "pg";

export const pool = new Pool({ connectionString: process.env.DATABASE_URL });
```

Prisma with `@prisma/adapter-pg` and Drizzle with `drizzle-orm/node-postgres`
both use `pg` underneath, so the same URL works. Do not add
`rejectUnauthorized: false`; that turns verification off.

## Python: psycopg

psycopg 3 uses libpq. With libpq 16 or newer:

```python theme={null}
import os
import psycopg

conn = psycopg.connect(
    os.environ["DATABASE_URL"],
    sslmode="verify-full",
    sslrootcert="system",
)
```

## Troubleshooting

* `certificate verify failed` or `unable to get local issuer certificate`:
  the client cannot find a trusted CA store. Use `sslrootcert=system` with
  libpq 16+, or point `sslrootcert` at the system CA bundle.
* `server certificate does not match host name`: connect with the exact host
  name shown in the dashboard, not an IP address.
* `sslrootcert=system` rejected: your libpq is older than 16. Use a CA bundle
  path instead.

See [Quickstart](/quickstart) for connection details and
[Database roles](/guides/database-roles) to choose which login to use.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.