Connection strings and managed databases

Connection string format

postgresql://user:password@host:5432/database
mysql://user:password@host:3306/database
sqlserver://user:password@host:1433/database

TLS and certificates

Connections over the internet are always encrypted with TLS, and the database's server certificate is always verified. The database must have TLS enabled and use a certificate issued by a public certificate authority that matches its host name.

Connection strings that turn off encryption or verification (sslmode=disable, ssl-mode=DISABLED, encrypt=false, trustServerCertificate=true and so on) cannot be registered. Parameters that point to certificate files (such as sslrootcert) are not supported either, so certificates issued by a private certificate authority cannot be verified.

Source addresses

Scandock connects from Cloudflare's network, and its source IP addresses are not fixed. If your database restricts connections by IP address or is not exposed to the internet, use Cloudflare Tunnel.

Managed databases

Whether you can connect directly depends on whether the service's server certificate comes from a public certificate authority.

• Neon, PlanetScale, TiDB Cloud, Azure SQL Database: These use certificates from public certificate authorities, so you can connect directly with a connection string. If the service restricts source IP addresses, that restriction must be lifted.
• Amazon RDS, Aurora, Google Cloud SQL: These use the service's own certificate authority, so you cannot connect directly. Run cloudflared inside the VPC and use Tunnel (with the conditions below).

Conditions for RDS and Cloud SQL over Tunnel

• The target can be a host name: You can enter the database's host name (as assigned by Amazon RDS, Aurora, Cloud SQL or Azure) as the tunnel target. cloudflared resolves it with the DNS inside your VPC, so you do not need to recreate the tunnel when the database's IP address changes after a failover.
• Plaintext from cloudflared to the database: The tunnel itself is encrypted, but traffic from cloudflared to the database does not use TLS, so a database that requires TLS cannot be reached. The section below shows which databases work with their default settings.

Does it work over Tunnel with default settings?

Whether TLS is required by default depends on the service and version. A database that requires TLS can be reached once that requirement is turned off.

• Works: Amazon RDS for MySQL and MariaDB (require_secure_transport defaults to OFF), Aurora MySQL 3, RDS for SQL Server (rds.force_ssl defaults to 0), and RDS for PostgreSQL 14 and earlier.
• Requires turning off TLS enforcement: RDS for PostgreSQL 15 and later (set rds.force_ssl to 0 in the parameter group), and Aurora MySQL 8.4 (set require_secure_transport to OFF).
• Cloud SQL: Works unless "Allow only SSL connections" is enabled.