Secure connections (SSH, SSL, PuTTY)
Reach a database through an SSH server, or encrypt the connection with SSL.
Last updated November 4, 2026
- SSH tunnel
- Fill in the fields
- Private keys
- The server key question
- When the tunnel does not connect
- SSL
- SSH for SQL Server, Oracle and Firebird
SSH tunnel
An SSH tunnel reaches a database that is not open to the internet.
DBConvert logs in to a server you can reach over SSH. That server passes the database traffic on, and the traffic between you and it is encrypted.
The tunnel is built in for MySQL / MariaDB, PostgreSQL and IBM DB2 connections. Nothing else needs to be installed or running.
Typical cases:
- A database on a VPS with only port 22 open. The database listens on the server itself. Set Host to
127.0.0.1. - Hosting with SSH access. The provider gives you an SSH login, and the database is not reachable from outside. Use the database host name from the hosting panel.
- A cloud database behind a bastion host. The database has a private address in the cloud network. Use the bastion as the SSH server and the private address as Host.
Fill in the fields
In the connection dialog, set Connection route to SSH tunnel.
Host and Port are the database as the SSH server sees it, not as your computer sees it. Username and Password are the database user.
In the SSH tunnel block:
- SSH host and SSH port: the SSH server. The port is usually 22.
- Authentication: Password, Private key, or Both when the server asks for a key and a password.
- SSH username: your login on the SSH server.
- SSH password: its password, for password authentication.
- Private key and Key password: the key file, and its passphrase if it has one.
Click Connect. The dialog lists the databases when the tunnel and the database login both work.
In the previous interface and DBConvert Studio
Tick Use SSH (in Studio, open the SSH tab) and fill in the SSH host, port, login, and the password or key. Leave SSH version on SSH2. Click Connect (Test connection in Studio).
Private keys
DBConvert reads keys in the OpenSSH format, the format ssh-keygen writes:
- ed25519, the usual key today;
- ECDSA;
- RSA, in the OpenSSH or the older PEM format.
A key with a passphrase needs it in Key password.
A PuTTY .ppk key does not work as it is. Open it in PuTTYgen and choose Conversions → Export OpenSSH key.
The public half of the key must be in ~/.ssh/authorized_keys of the SSH user on the server.
The server key question
On the first connection to an SSH server, DBConvert shows the server's key and asks whether to trust it.
Compare the key with the one from the server's administrator. On the server, ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub prints it. Then click Trust and connect.
The key is remembered for this Windows user. Later connections do not ask again.
If the server's key changes, DBConvert shows both keys and does not connect until you trust the new one. Trust it only if the administrator confirms the change.
Scheduled jobs and the command line do not ask. They refuse an SSH server whose key is unknown or changed. Connect to the server once in the window and trust its key before you schedule the job.
When the tunnel does not connect
| The message starts with | What to do |
|---|---|
| The SSH server at … refused the user name or password | Check SSH username and SSH password. These are the SSH login, not the database user. |
| The private key cannot be used: its format is not supported, or its passphrase is wrong | Check Key password. A .ppk key: export it in the OpenSSH format, see Private keys. |
| The SSH server at … did not accept this key for the user | Add the public key to ~/.ssh/authorized_keys of that user, or pick the key that is there. |
| Cannot connect to the SSH server at … | Check SSH host and SSH port, and that a firewall lets your computer reach that port. |
If the tunnel opens but the database refuses, check Host and Port as the SSH server sees them, and the database user.
SSL
Use SSL when the database server exposes an SSL endpoint (Azure SQL, Cloud SQL, RDS with forced SSL).
DB2 connections have no SSL settings. Use the SSH tunnel.
Tick Use SSL/TLS (Use SSL in the previous interface) and provide:
- CA certificate - the certificate authority bundle.
- Cipher - cipher suite to use.
- For mutual TLS, also tick Use client certificate authentication and provide the Client certificate and Client key.
SSH for SQL Server, Oracle and Firebird
These connections have no built-in SSH tunnel. Open one yourself first:
- Forward a local port to the database with any SSH client: PuTTY (Connection → SSH → Tunnels) or
ssh -L 2000:db-host:1433 user@ssh-server. - In DBConvert, set Host to
127.0.0.1and Port to that local port. - Username and Password are the database user, not the SSH user.