{
  "slug": "heroku-data-pg-get-ca-retrieves-a-postgres-ca-bundle-c83c6074800f",
  "title": "heroku data:pg:get-ca retrieves a Postgres CA bundle",
  "tools": [
    "heroku"
  ],
  "tags": [
    "agent"
  ],
  "introduced_at": "2026-10-01T14:55:13.000Z",
  "announced_at": "2026-10-01T14:55:13.000Z",
  "effective_at": null,
  "date_basis": "source-publication",
  "status": "unknown",
  "how": {
    "incantation": "For an Essential or Advanced Postgres database, retrieve the CA bundle for its Heroku region. Use that bundle and `sslmode=verify-full` in the client connection URL.",
    "examples": [
      "heroku data:pg:get-ca --region us",
      "psql \"$(heroku config:get TEST_URL -a <app>)?sslmode=verify-full&sslrootcert=$HOME/.postgresql/us-east-1-bundle.pem\""
    ],
    "gotchas": [
      "Version: v11.11.0",
      "--region <value> (required): Heroku region or `global` for the AWS global CA bundle. `us` maps to `us-east-1`; `eu` maps to `eu-west-1`.",
      "sslmode=verify-full (required): Connection URL parameter used in the release-note example for a verifiable TLS connection.",
      "sslrootcert=<path> (required): Connection URL parameter set to the retrieved CA bundle path in the release-note example.",
      "-a <app> (required): Select the Heroku app whose `TEST_URL` config var supplies the database connection URL.",
      "Prerequisite: Use Heroku CLI to retrieve the app config var; install Postgres locally to connect directly with `psql`.",
      "The stated database scope is Essential and Advanced Postgres."
    ]
  },
  "why_it_matters": "Configure a client connection to an Essential or Advanced Postgres database to verify TLS.",
  "sources": [
    "https://github.com/heroku/cli/releases/tag/v11.11.0",
    "https://github.com/heroku/cli/pull/3880",
    "https://github.com/heroku/cli/blob/v11.11.0/src/commands/data/pg/get-ca.ts",
    "https://devcenter.heroku.com/articles/connecting-to-heroku-postgres-databases-from-outside-of-heroku"
  ],
  "rank": 0.93026,
  "judge": {
    "publish": true,
    "judge_model": "codex-cli/gpt-6-luna+typesafe/jev-1.13.0",
    "prompt_version": "extract-v7+enrich-v2+judge-v2x3+jev-publish-v1"
  },
  "review_state": "approved",
  "provenance": {
    "run_id": "wave2a-20261017",
    "verdict_id": "wave2a-20261017:wave2a-20261017-e39f035031d80e59-1:gate",
    "evidence_hash": "9e227f2bb3fe6c55386a713d8f087bc49ca469a998d2a6c0ea20485d570327df"
  },
  "review": {
    "draft_hash": "baff62e5b4a3c6b50acfb9f4c9ffd352aa1eda6cdbaa005ef0a40c94cad61a0f",
    "reviewer": "publication-gate",
    "reviewed_at": "2026-10-07T00:00:00.000Z",
    "decision": "wave2a-20261017:gate",
    "reason": "3 of 3 judge runs approved with p_yes >= 0.9 (mean 0.93 >= 0.9; 2 needed) and Jev gave 0.75 (>= 0.6 needed)."
  }
}