---
title: "Discussion on \"SSL Configuration for PostgreSQL: From Nginx Proxy Issues to Direct Database SSL\" | Hashnode"
description: "Discussion on \"SSL Configuration for PostgreSQL: From Nginx Proxy Issues to Direct Database SSL\". Understanding the Differences Between Database SSL and HTTP SSL (And ways to resolve issues)"
url: "https://hashnode.com/posts/postgresql-ssl-nginx-proxy-handshake-fix-guide/68aad9477f20453ecfc46a71"
---

[Feed](https://hashnode.com/feed) /

Discussion

# [SSL Configuration for PostgreSQL: From Nginx Proxy Issues to Direct Database SSL](https://configcraft.hashnode.dev/postgresql-ssl-nginx-proxy-handshake-fix-guide?utm_source=hashnode&utm_medium=feed)

Understanding the Differences Between Database SSL and HTTP SSL (And ways to resolve issues)

Aug 24, 2025 · 6 min read · configcraft.hashnode.dev  
Read the article

-   [#postgresql-ssl-wrong-version-number](https://hashnode.com/tag/postgresql-ssl-wrong-version-number)
-   [#database-ssl-vs-http-ssl](https://hashnode.com/tag/database-ssl-vs-http-ssl)
-   [#ssl-handshake-failure](https://hashnode.com/tag/ssl-handshake-failure)
-   [#postgresql](https://hashnode.com/tag/postgresql)
-   [#ssltls-handshake](https://hashnode.com/tag/ssltls-handshake)
-   [#nginx](https://hashnode.com/tag/nginx)
-   [#nomad](https://hashnode.com/tag/nomad)
-   [#database-security](https://hashnode.com/tag/database-security)
-   [#devops-articles](https://hashnode.com/tag/devops-articles)
-   [#nginx-ssl-handshake-failed](https://hashnode.com/tag/nginx-ssl-handshake-failed)

## Written by

[Sushant Pupneja](https://hashnode.com/@sushantpupneja)

@sushantpupneja · Doha, Qatar

  
[View profile](https://hashnode.com/@sushantpupneja)

Passionate about simplifying complex machine learning and AI concepts to make them accessible and actionable for all learners.

## Responses 1

Markdown supported · ⌘↵ to post

[CDN Edge Ops](https://hashnode.com/@cdnedgeops)

[Oct 31](https://hashnode.com/posts/postgresql-ssl-nginx-proxy-handshake-fix-guide/68aad9477f20453ecfc46a71/comment/6ae56a0fe51163130654721e)

Useful walkthrough of why Postgres SSL and an HTTP reverse proxy do not compose the way people expect. Postgres speaks its own TLS profile on the wire; sticking nginx http{} in front of 5432 usually breaks the startup packet or leaves you terminating the wrong protocol. When I need encrypted DB access from apps outside the VPC I terminate TLS at Postgres itself (ssl=on, verify-full on the client) or use a dedicated TCP/TLS proxy that understands the Postgres protocol, not a generic HTTP proxy\_pass.

Operationally I keep two checks after any change: openssl s\_client -starttls postgres against the advertised host:port, and a libpq connection with sslmode=verify-full using the same CA the apps trust. If apps sit behind nginx for HTTP only, leave 5432 off the public listener entirely and reach the DB over a private network or SSH tunnel. Mixing "we put nginx in front of everything" with database ports is the fastest way to get intermittent handshake failures that look like auth bugs.