SSL Certificates

Last updated July 29, 2026 · By the SaturnSQL team

With SSL enabled, SaturnSQL checks three things about your database's certificate: that a trusted authority signed it, that it has not expired, and that it matches the hostname you connected to. Most databases need nothing configured. Some need one certificate pasted in.

Databases that work with no setup

SaturnSQL trusts the public certificate authorities, plus every Amazon RDS regional authority. So RDS and Aurora, Azure SQL and Azure Database for PostgreSQL/MySQL, Neon, Supabase, PlanetScale and anything using a normal public certificate all verify correctly with SSL on and nothing else touched.

Databases that need a CA certificate

Some providers generate their own certificate authority for each instance. Nobody else has it, so there is nothing SaturnSQL could ship in advance. You will see this error:

That is expected on Google Cloud SQL, Aiven, DigitalOcean, Heroku Postgres and most self-hosted servers. It does not mean anything is broken; SaturnSQL simply has not been told which authority to trust yet.

Adding the certificate

1. Open Settings → Connections and click Edit on the connection.
2. Make sure SSL enabled is ticked.
3. Expand Advanced.
4. Paste the certificate into CA certificate.
5. Click Test Connection, then save.

Paste the whole PEM block, including the -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- lines. A chain of several certificates is fine. Header lines above the certificate, such as the subject= and issuer= lines that openssl prints, are ignored, so you can paste a whole console dump without trimming it.

If the CA certificate field is not visible, one of two things is true: SSL is switched off for that connection, or Allow expired or mismatched certificates is ticked. Untick the latter and the field appears, since a certificate to verify against has no meaning when verification is off.

Where to get it

• Google Cloud SQL: your instance → Connections → Security → download the server CA. Or gcloud sql instances describe INSTANCE --format="value(serverCaCert.cert)"
• Aiven: service Overview → Connection information → CA certificate → Download
• DigitalOcean: database cluster → Overview → Connection details → Download CA certificate
• Heroku Postgres: the CA bundle from your add-on's credentials page
• Self-hosted: the certificate of the authority that signed your server certificate, not the server certificate itself. If you signed it yourself, that is your ca.crt

What pasting a certificate changes

The certificate you paste becomes the only authority trusted for that connection. It replaces the default list rather than adding to it, which is the same behaviour as sslrootcert= in psql. That is the point: your instance's authority is the only one that should ever vouch for your server, so no public authority can be used to impersonate it.

One consequence worth knowing: on an Amazon RDS connection, a pasted certificate overrides the built-in RDS authorities. RDS needs no certificate, so leave the field empty there.

To undo it, clear the field and save. The connection returns to the default trusted authorities.

The other option, and why it is weaker

Allow expired or mismatched certificates in the same Advanced section switches verification off. Traffic stays encrypted, but the server is no longer proven to be yours, so anyone positioned between SaturnSQL and your database could impersonate it. It is the right tool for a throwaway server you control and the wrong one for production.

A CA certificate solves the same connection failure without giving that up. Reach for it first.

Other certificate errors

• certificate has expired— the server's certificate is past its date. Renew it on the server; a CA certificate will not help.
• Hostname/IP does not match — the certificate was issued for a different name than the host you entered. Use the hostname the certificate was issued for, connecting by name rather than by IP address.
• self signed certificate — the server signed its own certificate. Paste that certificate into the CA certificate field to trust it explicitly.
• "That looks like a private key" — you pasted a key rather than a certificate. The right file starts with -----BEGIN CERTIFICATE-----. SaturnSQL never needs a private key.

Still failing? Check that the database is reachable at all first — a firewall blocking SaturnSQL can surface as a timeout rather than a certificate error. See the static IP address guide for the address to allow, and connecting a database for the rest of the setup.