# PostgreSQL Connections

Martin supports standard PostgreSQL connection string settings including `host`, `port`, `user`, `password`, `dbname`, `sslmode`, `connect_timeout`, `keepalives`, `keepalives_idle`, etc. See the [PostgreSQL docs](<https://www.postgresql.org/docs/current/libpq-connect.html#LIBPQ-CONNSTRING>) for more details.

### SSL Connections

Martin supports PostgreSQL `sslmode` settings: `disable`, `prefer`, `require`, `verify-ca` and `verify-full`. See the [PostgreSQL docs](<https://www.postgresql.org/docs/current/libpq-ssl.html>) for mode descriptions. Certificates can be provided in the [configuration file](<https://maplibre.org/martin/config-file/index.md>) or on the command line with `--ssl-cert`, `--ssl-key` and `--ca-root-file`. The command line flags apply to all PostgreSQL connections.

By default, `sslmode` is `prefer` - encrypt (don't check certificates) if the server supports it, but the connection proceeds without SSL if not supported. This matches `psql` default behavior.

If you require guarantees regarding [eavesdropping](<https://en.wikipedia.org/wiki/Eavesdropping>) or [MITM protection](<https://en.wikipedia.org/wiki/Man-in-the-middle_attack>), you need a different option. Use the `sslmode` parameter to specify a different mode:

```bash
martin postgres://user:password@host/db?sslmode=verify-full
```

For a practical walkthrough of SSL certificate setup - including creation, configuration, and troubleshooting - see our [PostgreSQL SSL Certificates Recipe](<https://maplibre.org/martin/pg-ssl-certificates/index.md>).