Skip to content

Commit 972a2ef

Browse files
Updated SSL Modes, Fixed wrong note about the SSL
1 parent 5d3af3c commit 972a2ef

File tree

1 file changed

+26
-7
lines changed

1 file changed

+26
-7
lines changed

docs/databases/ssl.md

Lines changed: 26 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -30,20 +30,19 @@ To secure your database connection with SSL:
3030
Choose the SSL mode from the dropdown menu. For example, select **verify-full** for maximum security.
3131
<ZoomableImage src="/docs/images/database/ssl/3.webp" />
3232

33+
::: warning **Note:**
34+
To make use of SSL after enabling it, you need to use the new connection URL for your app, which includes the SSL configuration.
3335

34-
::: warning **Note:**
35-
For some databases like PostgreSQL, SSL might already be enforced through the connection string.
36-
37-
For others, such as Redis-based databases, enabling this setting is essential.
36+
If you are not using the new URL, the database connection will not use SSL (in most cases).
3837
:::
3938

4039
Coolify automatically binds the generated certificates and keys to the required locations, so manual changes are only needed if you wish to use custom certificates.
4140

42-
4341
## 2. SSL Modes Explained
4442
Coolify supports several SSL modes, each providing a different level of security:
4543
<ZoomableImage src="/docs/images/database/ssl/4.webp" />
4644

45+
### PostgreSQL
4746
- **allow (insecure)**
4847
This mode permits both encrypted and unencrypted connections. It does not enforce SSL, so if SSL fails, the connection will fall back to an unencrypted state.
4948

@@ -69,8 +68,26 @@ Coolify supports several SSL modes, each providing a different level of security
6968

7069
This provides full assurance that you are connecting to the correct server, similar to the security level provided by Cloudflare Origin Certificate setups.
7170

71+
### Other Databases
72+
- **MySQL & MongoDB:**
73+
Only the following modes are available: **prefer, require, verify ca, verify full**.
74+
- **MariaDB, Redis, KeyDB, DragonFly DB:**
75+
No SSL modes are visible in the UI.
76+
- **Clickhouse DB:**
77+
SSL is not supported, there is no checkbox to enable SSL nor dropdown options.
78+
79+
::: warning Developer Note
80+
Modes lower than **require** are not 100% secure as they only encrypt the connection without full verification of the server’s identity.
81+
82+
For modes higher than **require** (i.e., **verify-ca** and **verify-full**), you must mount the Coolify CA certificate into the container that connects to the database for additional security.
83+
84+
Note that in most cases (for example, PostgreSQL), merely enabling SSL does nothing unless you use the new connection URL that enforces SSL.
85+
86+
However, for some databases, like the redis-based ones, enabling SSL in the UI does enforce the mode.
87+
:::
88+
7289
::: success Tip
73-
For maximum security, **verify-full** is recommended.
90+
For maximum security, **verify-full** is recommended (when available).
7491
:::
7592

7693

@@ -86,7 +103,9 @@ In the dashboard, under **Servers > YOUR_SERVER_NAME > Proxy > Advanced**, you c
86103

87104

88105
### Recommended Configuration
89-
For secure connections, mount the Coolify CA certificate into all containers that need to connect to your databases. The recommended bind mount is:
106+
For secure connections, mount the Coolify CA certificate into all containers that need to connect to your databases.
107+
108+
The recommended bind mount is:
90109

91110
```sh
92111
/data/coolify/ssl/coolify-ca.crt:/etc/ssl/certs/coolify-ca.crt:ro

0 commit comments

Comments
 (0)