Database SSL

Coolify can generate a server certificate for supported standalone databases and add the certificate to the database container. For engines that expose SSL connection parameters, the General page also includes those parameters in the generated internal and public connection URLs.

SSL settings are changed from the database's Configuration > General page. Stop the database before changing Enable SSL or SSL Mode, then restart it after saving so the generated certificate and connection port are applied.

Update the connection URL

Applications use SSL only when their connection configuration enables it. Copy the new Internal URL or Public URL after enabling SSL and update the application that connects to the database.

Enable SSL

Stop the database.
Open Configuration > General.
Enable Enable SSL.
Choose an SSL Mode when the database provides that field.
Select Save if other configuration changed, then restart the database.

Coolify creates a database certificate signed by the CA certificate for the database's server. If no server CA certificate exists, Coolify attempts to generate one. The certificate status and expiration date appear on the database's General page.

To regenerate a database certificate, use Regenerate SSL Certificates on the General page, then restart the database. A regenerated certificate can require the connecting application to trust the server CA again.

SSL modes

PostgreSQL exposes these modes. The default is require.

Mode	Behavior
`allow`	Allows an unencrypted connection and does not require SSL.
`prefer`	Tries SSL first, then can fall back to an unencrypted connection.
`require`	Requires encryption but does not verify the server certificate.
`verify-ca`	Requires encryption and verifies the certificate authority.
`verify-full`	Requires encryption, verifies the CA, and verifies the server hostname.

Use verify-ca or verify-full only when the client container trusts the Coolify CA certificate.

Trust the Coolify CA certificate

When the connection URL requires certificate verification, mount the server CA certificate into the application container that connects to the database. The common mount used by Coolify clients is:

/data/coolify/ssl/coolify-ca.crt:/etc/ssl/certs/coolify-ca.crt:ro

The path on the left is on the database server. The path on the right is inside the application container. Configure the application or Compose service to trust /etc/ssl/certs/coolify-ca.crt using the client library's CA option.

Redis, Dragonfly, and KeyDB do not expose a normal SSL mode selector. Their generated URLs use rediss and port 6380; configure CA verification in the client library when required. The generated URL does not add a CA parameter for these engines.

For a Compose application, define the mount on the service that opens the database connection, not only on the database service.

Verify the connection

After restarting the database:

Copy the updated connection URL from the database's General page.
Confirm the client container contains the CA file when using certificate verification.
Run the application's database connection check or a simple query.
Open the database logs if the connection fails.

A URL that still uses the old non-SSL parameters can connect without SSL or fail, depending on the engine and client. Update the consuming application configuration rather than editing only the database resource.

Server CA management

Open the server's advanced CA certificate settings to view or regenerate the server CA certificate. Regenerating a server CA can invalidate certificates signed by the previous CA; restart affected databases and update clients that trust the CA before using the new certificate.