Use TLS with database connections
Turn on Use TLS with certificate verification in the connection dialog to encrypt a MySQL, ClickHouse, MongoDB, Redis or Kafka connection. DevOpsPad then requires TLS 1.2 or newer, verifies the server certificate against your operating system’s trusted CAs, and checks that it matches the Host you entered.
There is no “skip verification” switch. If the certificate is self-signed or issued for a different name, the connection fails with a TLS error instead of connecting insecurely.
What changes per engine
| Engine | With TLS on |
|---|---|
| MySQL | TLS with system CAs and host name verification |
| ClickHouse | HTTPS instead of HTTP. Use port 8443, for example for ClickHouse Cloud |
| MongoDB | TLS with system CAs and host name verification |
| Redis | TLS; DevOpsPad switches to the upstream go-redis client to keep the verified TLS configuration |
| Kafka | TLS for the bootstrap broker and every advertised broker; each broker is verified against its own advertised name |
| Kubernetes / K3s | Not in the dialog. TLS comes from your kubeconfig: its CA, client certificates and server name |
Steps
- Open New connection or Edit connection.
- Enter the Host exactly as it appears in the server certificate (a DNS name, not an IP address, unless the certificate lists the IP).
- Check Use TLS with certificate verification.
- Change the port if the TLS listener is different, for example
8443for ClickHouse. - Click Test connection.
TLS through an SSH tunnel
TLS and SSH are independent. When you tunnel, the TLS session still runs end to end with the database and is verified against the database Host, not the SSH server. Use the host name in the certificate, which the SSH server must be able to resolve. localhost will only verify if the certificate is issued for localhost. See SSH troubleshooting.
Not supported yet
- Custom CA bundles and client certificates (mutual TLS) for databases.
- Disabling certificate or host name verification.
- Per-connection minimum TLS version settings.
If your server uses a private CA, add that CA to the macOS keychain as trusted so the system trust store accepts it, or connect through an SSH tunnel without TLS when the network path to the database is otherwise private.
Frequently asked questions
Can I skip certificate verification for a self-signed certificate?
No. DevOpsPad has no option to disable verification. The server certificate must chain to a CA trusted by your operating system and match the host name you entered.
Can I use a custom CA file or a client certificate?
Not yet. Custom TLS certificates for databases are on the list of unimplemented features. Kubernetes connections use the CA and client certificates from your kubeconfig.