Q:

Force PostgreSQL clients to use SSL?

I have configured ssl = on in postgresql.conf (and installed a certificate etcetera). Does this ensure that all clients will always connect over SSL?
(I.e. does ssl = on it make it impossible to connect without SSL encryption?)
Are there other ways to ensure that all clients always connect over SSL/TLS?

A:

ssl = on only enables the possibility of using SSL.
To ensure that all clients are using SSL, add hostssl lines in pg_hba.conf, e.g.,
hostssl  all  all  0.0.0.0/0  md5

and remove all host lines.  (Well, maybe keep the ones for localhost.)
If the desire is to force the client to send a certificate, then md5 has to be changed to cert. e.g.,
hostssl  all  all  0.0.0.0/0  cert

A:

No, that simply enables the use of SSL. You need to also make the appropriate changes to your pg_hga.conf file.

