Connect to PostgreSQL with psql and SSL

State all five connection dimensions

psql -X \
  --host=db.example.com \
  --port=5432 \
  --username=app_reader \
  --dbname=commerce

Host, port, database, user, and TLS parameters identify the target together. A database name alone is insufficient; many instances can contain the same name.

Equivalent connection URI:

psql -X "postgresql://app_reader@db.example.com:5432/commerce?sslmode=verify-full"

Do not place passwords in command-line URIs, source code, or logs. Use an interactive prompt, secret manager, short-lived identity, .pgpass, or a libpq service file.

pgpass

The Unix default is ~/.pgpass, restricted to mode 0600:

hostname:5432:database:username:password

chmod 600 ~/.pgpass

The Windows default is %APPDATA%\postgresql\pgpass.conf. Wildcards broaden where a credential applies; prefer a specific host, database, and user.

SSL modes

verify-full requires the URI host to match the certificate identity and a correct root certificate. Cloud providers can have CA rotation workflows; do not pin an expired certificate forever.

Confirm immediately after connecting

\conninfo
SELECT
  current_database(), current_user, session_user,
  inet_server_addr(), inet_server_port(),
  current_setting('server_version') AS server_version,
  current_setting('TimeZone') AS timezone;

For scripts:

psql -X --set ON_ERROR_STOP=on --file migration.sql "$DATABASE_URL"

-X prevents a user's .psqlrc from changing automation; ON_ERROR_STOP exits on SQL errors. See the PostgreSQL 18 psql documentation for exit-status semantics.

On failure, retain the full error and SQLSTATE, then use the error fieldbook. Do not troubleshoot by disabling TLS or broadening privileges.