# MTLS between kong and postgres

**URL:** <https://discuss.konghq.com/t/mtls-between-kong-and-postgres/13505>\
**Category:** Questions\
**Tags:** kong-gateway\
**Created:** [April 23, 2025, 11:12am UTC](https://discuss.konghq.com/t/mtls-between-kong-and-postgres/13505 "2025-04-23T11:12:51Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sudhir\_Jaiswal](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/sudhir_jaiswal/32/4685_2.png) [@Sudhir\_Jaiswal](https://discuss.konghq.com/u/Sudhir_Jaiswal)\
**Post date:** [April 23, 2025, 11:12am UTC](https://discuss.konghq.com/t/mtls-between-kong-and-postgres/13505/1 "2025-04-23T11:12:51Z")

</div>

Do we have support for MTLS in kong OSS with Postgresql?  
i saw this [Configuring PostgreSQL TLS - Kong Gateway | Kong Docs](https://docs.konghq.com/gateway/latest/production/networking/configure-postgres-tls/#kong-gateway-mtls-configuration) configuration but it is not available in OSS kong.conf ,and it is nowhere written in doc?

---

<div class="post-metadata">

**Author:** ![matu](https://avatars.discourse-cdn.com/v4/letter/m/e9c0ed/32.png) [@matu](https://discuss.konghq.com/u/matu)\
**Post date:** [May 9, 2025, 4:07pm UTC](https://discuss.konghq.com/t/mtls-between-kong-and-postgres/13505/2 "2025-05-09T16:07:07Z")

</div>

As far as I understand the code, mTLS is indeed not possible in the OSS version.

You can enable TLS to postgres by setting these environment variables:

KONG\_PG\_SSL=on  
KONG\_PG\_SSL\_VERIFY=on  
KONG\_PG\_SSL\_VERSION=tlsv1\_3

and you can also validate the server-certificate by adding these env variables:

KONG\_PG\_SSL\_REQUIRED=on  
KONG\_LUA\_SSL\_TRUSTED\_CERTIFICATE=/path-to-your-database-truststore.pem

but the settings for mTLS client-certificate and key, as described for the Enterprise version, seems to be ignored by the OSS code.

The reason can be seen in the Kong code in the postgres connector here:

> <https://github.com/Kong/kong/blob/master/kong/db/strategies/postgres/connector.lua#L947>

The settings for “cert” and “key” are never initialised.

However if you are developer and are able to extend the Lua code, a workaround is quite simple. Kong uses the “pgmoon” library.  
Just add the missing lines as described in the ssl-example on the “pgmoon” githab page:

> **[GitHub - leafo/pgmoon: A pure Lua Postgres driver for use in OpenResty &...](https://github.com/leafo/pgmoon?tab=readme-ov-file#ssl-connections)**
>
> A pure Lua Postgres driver for use in OpenResty & more