heroku data:pg:get-ca retrieves a Postgres CA bundle
Introduced 2026-10-01 · score 0.93
HOW TO USE IT
For an Essential or Advanced Postgres database, retrieve the CA bundle for its Heroku region. Use that bundle and `sslmode=verify-full` in the client connection URL.
heroku data:pg:get-ca --region uspsql "$(heroku config:get TEST_URL -a <app>)?sslmode=verify-full&sslrootcert=$HOME/.postgresql/us-east-1-bundle.pem"WHY THIS HELPS
Configure a client connection to an Essential or Advanced Postgres database to verify TLS.
REQUIREMENTS AND LIMITATIONS
- Version: v11.11.0
- --region <value> (required): Heroku region or `global` for the AWS global CA bundle. `us` maps to `us-east-1`; `eu` maps to `eu-west-1`.
- sslmode=verify-full (required): Connection URL parameter used in the release-note example for a verifiable TLS connection.
- sslrootcert=<path> (required): Connection URL parameter set to the retrieved CA bundle path in the release-note example.
- -a <app> (required): Select the Heroku app whose `TEST_URL` config var supplies the database connection URL.
- Prerequisite: Use Heroku CLI to retrieve the app config var; install Postgres locally to connect directly with `psql`.
- The stated database scope is Essential and Advanced Postgres.
FIRST-PARTY EVIDENCE
- https://github.com/heroku/cli/releases/tag/v11.11.0
- https://github.com/heroku/cli/pull/3880
- https://github.com/heroku/cli/blob/v11.11.0/src/commands/data/pg/get-ca.ts
- https://devcenter.heroku.com/articles/connecting-to-heroku-postgres-databases-from-outside-of-heroku
Check the installed version and the source before using it. Entry JSON