--- schema_version: "1" id: 81cddb5e17fd34c8c867da9e3368b8269afcb2a267ccdfd94ebdb506c193e82d title: Configure SSL for Internal Postgres Communication collection: tableau version: next locale: en-gb portal_url: https://docs.salesforce.com/tableau/next/en-gb/server-linux/ssl_config_postgres.md canonical_url: https://help.tableau.com/v0.0/server-linux/en-gb/ssl_config_postgres.htm source_site: help.tableau.com content_type: documentation content_hash: 2a8f8025450f6099061b30d665ad91ea3f2ec763bc24048c0ea557e9002d8914 description: Configure SSL for internal Postgres repository communication. --- [Skip to main content](#main-content) # Configure SSL for Internal Postgres Communication You can configure Tableau Server to use SSL (TLS) for encrypted communication between the Postgres repository and other server components. By default, communication that is internal to Tableau Server components is not encrypted. While you enable support for internal SSL, you can also configure support for direct connections to the repository from Tableau clients, such as Tableau Desktop, Tableau Mobile, REST API, web browsers. **Note:** Beginning with version 2026.2.0, you can use custom certificates for Postgres communication. When custom certificates are enabled for Postgres, you cannot use the TSM UI to make changes. To enable custom certificates, you need to use the TSM command line. For details on how to enable custom repository certificates, see [tsm security repository-ssl enable](https://help.tableau.com/v0.0/server-linux/en-gb/cli_security_tsm.htm#postres-ssl-enable). 1. As a server administrator, open TSM in a browser: https://:8850 For more information, see [Sign in to Tableau Services Manager Web UI](https://help.tableau.com/v0.0/server-linux/en-gb/sign_in_tsm.htm). 2. On the Configuration tab, select Security > Repository SSL. ![Screen shot of the TSM Repository SSL settings](/tableau/next/en-gb/server-linux/en-gb/Img/postgres-ssl-config.png "Screen shot of the TSM Repository SSL settings") 3. Select one of the options for using repository SSL. - Required for all connections – uses SSL for internal Tableau Server communication, and requires SSL for Tableau clients and any external (non-Tableau) clients that connect directly to the postgres repository, including those using the **tableau** or **readonly** user. **Important:** Unless you complete the steps in [Configure Postgres SSL to Allow Direct Connections from Clients](https://help.tableau.com/v0.0/server-linux/en-gb/ssl_config_direct_cx.htm), to place the certificate files in the correct location on the client computers, Tableau clients and external postgres clients will not be able to validate the identity of the Tableau repository by comparing certificates on the client computers with the SSL certificate from the repository computer. - Optional for user connections – When enabled, Tableau uses SSL for internal Tableau Server communication, and supports but does not require SSL for direct connections to the server from Tableau clients and external clients. - Off for all connections (default) – Internal server communication is not encrypted, and SSL is not required for direct connections from clients. 4. Click OK. The first two options generate the server’s certificate files, **server.crt** and server.key, and place them in the following location. `/var/opt/tableau/tableau_server/data/tabsvc/config/pgsql_/security` Use this .crt file if you need to configure clients for direct connections. To enable SSL for internal traffic among the server components, run the following commands: `tsm security repository-ssl enable` `tsm pending-changes apply` ### What the command does `repository-ssl enable` generates the server’s certificate files, which it places in the following location: `/var/opt/tableau/tableau_server/data/tabsvc/config/pgsql_/security` By default, this command sets Tableau Server to require SSL for traffic between the repository and other server components, as well as for direct connections from Tableau clients (including for connections through the **tableau** or **readonly** users). To complete the configuration, you must also do the steps described in [Configure Postgres SSL to Allow Direct Connections from Clients](https://help.tableau.com/v0.0/server-linux/en-gb/ssl_config_direct_cx.htm), to place the certificate files in the correct location on the client computers. If the pending changes require a server restart, the `pending-changes apply` command will display a prompt to let you know a restart will occur. This prompt displays even if the server is stopped, but in that case, there is no restart. You can suppress the prompt using the `--ignore-prompt` option, but this does not change the restart behaviour. If the changes do not require a restart, the changes are applied without a prompt. For more information, see [tsm pending-changes apply](https://help.tableau.com/v0.0/server-linux/en-gb/cli_pending-changes.htm#pending-changes-apply). ### Option for repository-ssl enable If you want to require SSL only for internal Tableau Server communication, and not for direct connections from client apps, use the following option with the `repository-ssl enable` command: `--internal-only` ### Cluster environments If you run `repository-ssl enable` on a node in a cluster, it copies the required certificate file to the same location on each other node. For more information about downloading the public certificate for direct connections, see [Configure Postgres SSL to Allow Direct Connections from Clients](https://help.tableau.com/v0.0/server-linux/en-gb/ssl_config_direct_cx.htm).