Enable “Use SSL/TLS for this TCP connection,” then choose the verification level:
| TLS mode | Usage |
|---|---|
| REQUIRED | Traffic must be encrypted without verifying the identity of the server certificate. |
| VERIFY_CA | The certificate must be signed by the certificate authority you specify. |
| VERIFY_IDENTITY | Verifies the certificate authority and the server's DNS name. This is the recommended choice when full identity validation is possible. |
You can provide a certificate authority (CA) certificate, a CA directory, and a client certificate and its private key if your server requires TLS certificate authentication.
AWS RDS
Use the RDS DNS endpoint as the host, the global-bundle.pem file as the CA certificate, and VERIFY_IDENTITY mode.