---
schema_version: "1"
id: aa4c6ae6c460963f4588013a73710c83302ba8beeade8afee06c69e7b6ece5a9
title: Configure Postgres SSL to Allow Direct Connections from Clients
collection: tableau
version: next
locale: en-us
portal_url: https://docs.salesforce.com/tableau/next/en-us/server/ssl_config_direct_cx.md
canonical_url: https://help.tableau.com/v0.0/server/en-us/ssl_config_direct_cx.htm
source_site: help.tableau.com
content_type: documentation
content_hash: 48c4da59d66770bd7eb0c9e6780973a7acd787c82237759a9655fcd23972945c
description: Configure Postgres SSL to allow direct client connections to the repository.
---
[Skip to main content](#main-content)

# Configure Postgres SSL to Allow Direct Connections from Clients

When Tableau Server is configured to use SSL for internal communication with the postgres repository, you can also require Tableau clients and external postgres clients that connect directly to the repository to verify the identity of the Tableau postgres repository by comparing the SSL certificate presented by the internal postgres instance wit the certificate distributed to the Tableau or external postgres client.

Direct connections include those using the **tableau** user or the **readonly** user. Examples of Tableau clients include Tableau Desktop, Tableau Mobile, REST API, web browsers.

1. Enable internal SSL for the repository by running the following commands:
    
    `tsm security repository-ssl enable`
    
    `tsm pending-changes apply`
    
    This enables internal SSL support and generates new server certificate and key files, and requires all Tableau clients to use SSL to connect to the repository. For additional repository-ssl commands and options, see [tsm security](https://help.tableau.com/v0.0/server/en-us/cli_security_tsm.htm).
    
    If the pending changes require a server restart, the `pending-changes apply` command will display a prompt to let you know a restart will occur. This prompt displays even if the server is stopped, but in that case there is no restart. You can suppress the prompt using the `--ignore-prompt` option, but this does not change the restart behavior. If the changes do not require a restart, the changes are applied without a prompt. For more information, see [tsm pending-changes apply](https://help.tableau.com/v0.0/server/en-us/cli_pending-changes.htm#pending-changes-apply).
2. (Optional) If you have configured your client computer to validate Postgres SSL connections, then you must import the certificate that is generated by Tableau Server onto the computers running Tableau Desktop. For each client computer that will connect directly to the repository, do the following:
    
    - Copy the **server.crt** file to the client computer. You can find this file in the following directory:
        
        `C:/ProgramData/Tableau/Tableau Server/data/tabsvc/config/pgsql_0.<version_code>/security`
        
        **Note**: Do not copy **server.key** to the client computer. This file should reside only on the server.
    - Import the certificate into the computer’s certificate store.
        
        For information, use the documentation from the operating system manufacturer.
3. (Optional) Configure any external (non-Tableau) postgres clients (PgAdmin or Dbeaver for example) to verify the identity of the Tableau Server postgres repository. Do this in the postgresql JDBC driver the client is using to connect by setting the "sslmode" directive to "verify-ca" or "verify-full". The options available may be different depending on the version of the postgres driver being used. For more information, see the drive documentation about SSL support.