SSH tunnels and SSL/TLS
Reach private databases through an SSH tunnel and encrypt connections with SSL or TLS. Covers SSL modes, certificates and password or private-key SSH login.
On this page
Both options are switches in the connection form, for every engine except SQLite and MongoDB.
SSL / TLS#
Switch on SSL / TLS, then choose a mode. The available modes depend on the engine.
| Engine | Modes |
|---|---|
| PostgreSQL, Redshift | Disable, Prefer, Require, Verify CA, Verify full |
| MySQL, MariaDB | Disabled, Preferred, Required, Verify CA, Verify identity |
| Redis | TLS enabled, Verify CA, Verify full |
- Prefer tries SSL first and falls back to a plain connection.
- Require encrypts the connection but does not check who is on the other end.
- Verify CA also checks the server's certificate against a certificate authority you provide.
- Verify full additionally checks that the certificate matches the server's hostname. This is the strictest mode and the right choice for production.
For the verify modes, set the CA certificate path. If your server requires client certificates, also set the Client certificate path and Client key path. Managed databases such as AWS RDS and Azure publish their CA bundle for download.
SSH tunnel#
Use a tunnel when the database is not reachable directly, for example inside a private network behind a bastion host. RowDex connects to the SSH server first, then reaches the database through it.
Switch on SSH tunnel
Enable the SSH tunnel switch in the connection form.
Enter the SSH server
Fill in the SSH host, SSH port (22 by default) and SSH username.
Choose how to sign in
Select Password or Private key file. For a key, use Browse to pick the file, and add its passphrase if it has one.
Point the database fields at the private address
Host and port are resolved from the SSH server's point of view, so use the database's private hostname or IP, such as the internal RDS endpoint.
Guides for cloud databases#
Was this page helpful?