[Qgis-user] sharing project with pg user and ssl connection

Fri Aug 14 00:29:33 PDT 2026

Hi,

Thank you for these responses, it is indeed always the same dilemma at the end : security versus convenience and cost..
I will discuss this with my IT director, if the solution suggested by our provider in regards of the GDPR is considerate as safe enough.

Best regards

Scherzl Namik

-----Message d'origine-----
De : QGIS-User <qgis-user-bounces at lists.osgeo.org> De la part de HAUBOURG Régis via QGIS-User
Envoyé : jeudi 13 août 2026 16:15
À : qgis-user at lists.osgeo.org
Objet : Re: [Qgis-user] sharing project with pg user and ssl connection

[Vous ne recevez pas souvent de courriers de qgis-user at lists.osgeo.org. Découvrez pourquoi ceci est important à https://aka.ms/LearnAboutSenderIdentification ]

Hi Namik,
Sharing a authcfg ID among your users is probably a versatile solution.
I would suggest also that you take benefit of the postgres service files. It will provide an alias to a full connection string, and will allow you to move your server, port, or even database name without breaking QGIS projects. Only service files will need to be changed.
This requires you to deploy them on every user's profile.
pgpass file is an alternative to the authcg only for the password. It is less secure probably than a password manager in a Windows context.

  It is sustainable over time, most organizations do exactly this.

Regarding SSL, it depends on you security requirements and risk assessment and the kind of data you use.  If you don't require SSL, man in the middle attacks are possible.
SSL is fast enough for GIS, with a distant server. SSH port forwarding was not.
If your database is exposed on the internet, I would go for SSL. If you have a private network, no SSL will be a bit faster, but you often have other bottlenecks before this one hits you.  If you are using a VPN, If I record correctly, SSL won't add encryption overhead, but I might be wrong.
I use SSL with a distant database everyday, it works well.

Let's Encrypt can work. As for digital sovereignty, maybe also better choose a European provider for your certificate. Let's encrypt is a non profit organization based in the US. And SSL certificates are a very good entrypoint for a general kill-switch..

SSL will however give you the joy of monitoring SSL end of life and renewal, which adds costs and potential failures..

Best regards

On 13/08/2026 14:51, Namik SCHERZL - SLA via QGIS-User <qgis-user at lists.osgeo.org> wrote:
> Hello,
>
> In my structure we are currently migrate our GIS architecture from
> ESRI to Qgis & Postgres.
> We would like to know the most recommended method for authenticating
> PG via Qgis knowing that :
>
>
> * We want to avoid transmitting login / password information between
> users of the same project.
>
> * Securing the data flow.
>
> * we are keeping a few Arcgis licences, and they should have access to
> the DB
>
>
> I've seen that Qgis can store PG login and password in it's own local
> storage and in the case we define a common authcfg ID for all our
> users it's possible for several users to share the same project
> without transferring any information/ rights.
>
> https://list/
> s.osgeo.org%2Fpipermail%2Fqgis-user%2F2019-November%2F044321.html&data
> =05%7C02%7Cscherzl.namik%40agglo-saint-louis.fr%7Ca5f42730d9de40fc5149
> 08def9453b1b%7C504ab4e3624142b2860ce47fe4029fea%7C0%7C0%7C639222272925
> 372911%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDA
> wMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sda
> ta=AYqx034gM0eCTYZucwfAwUrHQZvx8F5dNwoQepZ3EmQ%3D&reserved=0
> <https://lis/
> ts.osgeo.org%2Fpipermail%2Fqgis-user%2F2019-November%2F044321.html&dat
> a=05%7C02%7Cscherzl.namik%40agglo-saint-louis.fr%7Ca5f42730d9de40fc514
> 908def9453b1b%7C504ab4e3624142b2860ce47fe4029fea%7C0%7C0%7C63922227292
> 5408497%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMD
> AwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sd
> ata=n54S9g9hPZlY8%2BegrQVDnuNjag21Jhs5Fx6Hh99uVfA%3D&reserved=0>
>
>
> I have carried out conclusive tests; however, I would like to ensure
> *that this is a recommended practice and that this solution is
> sustainable over time*.
>
> Our service provider advises against securing our connection via an
> SSL certificate. For them, IP filtering is sufficient. However, I
> would like to know if there are any specific advantages or
> disadvantages to using an SSL certificate with QGIS ?
>
> Also, do you know if a Let's Encrypt type certificate works well in
> this context, or are there known compatibility issues?
>
> Thank you in advance for your feedback.
>
> Best regards,
>
>
> Namik Scherzl
>
>
> _______________________________________________
> QGIS-User mailing list
> QGIS-User at lists.osgeo.org
> List info:
> https://list/
> s.osgeo.org%2Fmailman%2Flistinfo%2Fqgis-user&data=05%7C02%7Cscherzl.na
> mik%40agglo-saint-louis.fr%7Ca5f42730d9de40fc514908def9453b1b%7C504ab4
> e3624142b2860ce47fe4029fea%7C0%7C0%7C639222272925429816%7CUnknown%7CTW
> FpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIs
> IkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=tbHC%2B%2BLbXXDuFf
> U2fccPG49bQZFuQk9Lu8GJ9%2Fr1QM8%3D&reserved=0
> Unsubscribe:
> https://list/
> s.osgeo.org%2Fmailman%2Flistinfo%2Fqgis-user&data=05%7C02%7Cscherzl.na
> mik%40agglo-saint-louis.fr%7Ca5f42730d9de40fc514908def9453b1b%7C504ab4
> e3624142b2860ce47fe4029fea%7C0%7C0%7C639222272925450687%7CUnknown%7CTW
> FpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIs
> IkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=TQzi434bkZ2BPT7oPJ
> dkZU6RN1ZTpHbJu94CqJ5M1sw%3D&reserved=0
>
_______________________________________________
QGIS-User mailing list
QGIS-User at lists.osgeo.org
List info: https://lists.osgeo.org/mailman/listinfo/qgis-user
Unsubscribe: https://lists.osgeo.org/mailman/listinfo/qgis-user