TLS modes, CA & client certificates

✓ functional

Choose how PostgreSQL and MySQL connections encrypt, trust, and authenticate - from prefer to verify-full with your own certs.

Choose exactly how a PostgreSQL or MySQL connection verifies the server. The four-way TLS mode dropdown replaces the old two checkboxes: Disable connects in plaintext, Require encrypts without verifying the server's certificate, Verify CA checks the certificate chain but not the hostname, and Verify full checks both.

Your own CA, and mutual TLS

Servers signed by a private or cloud CA - RDS, Cloud SQL, Azure, or your company's own - verify cleanly when you point the connection at your CA file (PEM) instead of trusting every certificate. Hardened servers that demand mutual TLS can present a client certificate and its key.

Browse buttons in the connection editor set the CA file, client certificate, and client key.
Files stay on disk - only their paths are saved with the connection, and paths are what exported connections carry too.
Connection strings work - pasted strings are read for sslmode, sslrootcert, sslcert, sslkey, and the MySQL ssl-mode / ssl-ca / ssl-cert / ssl-key spellings.

Unencrypted keys only. A passphrase-protected key is refused with a clear message rather than a mysterious handshake failure - export an unencrypted PEM copy for SQLly to use.