sslmode=require

https://www.postgresql.org/docs/current/libpq-ssl.html

For backwards compatibility with earlier versions of PostgreSQL, if a root CA file exists, the behavior of sslmode=require will be the same as that of verify-ca, meaning the server certificate is validated against the CA. Relying on this behavior is discouraged, and applications that need certificate validation should always use verify-ca or verify-full.

See also

• PostgreSQL: psql, .psqlrc, .pgpass, $HOME/.pg service.conf, -U, -W, -d, meta-commands: \du, \dg, \ddp, \dp, \list, \dn, \dt, \c, \l, \di, \q, show users, show, su - postgres, psql -c, \?, \connect, \conninfo, --version, --help, PL/pgSQL