---
title: Database Access FAQ
description: Frequently asked questions about Teleport Database Access.
---

## Which database protocols does Teleport Database Access support?

Teleport Database Access currently supports the following protocols:

- MariaDB
- Microsoft SQL Server
- MongoDB
- MySQL
- PostgreSQL
- Redis
- Snowflake

For PostgreSQL and MySQL, the following Cloud-hosted versions are supported in addition to self-hosted deployments:

- Amazon RDS
- Amazon Aurora (except for Amazon Aurora Serverless, which doesn't support IAM authentication)
- Amazon Redshift
- Google Cloud SQL
- Azure Database

See the available [guides](./guides.mdx) for all supported configurations.

## Which PostgreSQL protocol features are not supported?

The following PostgreSQL protocol features aren't currently supported:

- [Canceling requests in progress](https://www.postgresql.org/docs/current/protocol-flow.html#id-1.10.5.7.9).
  Cancel requests issued by the PostgreSQL clients connected to the Teleport
  Proxy Service won't be passed to the database server.
- Any [authentication methods](https://www.postgresql.org/docs/current/auth-methods.html)
  except for client certificate authentication and IAM authentication for cloud
  databases.

## Can database clients use a public address different from the web public address?

<Tabs>
<TabItem scope={["oss", "enterprise"]} label="Self-Hosted">

When configuring the Teleport Proxy Service, administrators can set the
`postgres_public_addr` and `mysql_public_addr` configuration fields to public
addresses over which respective database clients should connect. See
[Proxy Configuration](./reference/configuration.mdx#proxy-configuration) for
more details.

This is useful when the Teleport Web UI is running behind an L7 load balancer
(e.g. ALB in AWS), in which case the PostgreSQL/MySQL proxy needs to be exposed
on a plain TCP load balancer (e.g. NLB in AWS).

</TabItem>
<TabItem scope={["cloud"]} label="Teleport Cloud">

In Teleport Cloud, the Proxy Service uses the following ports for
Database Access client traffic:

|Configuration setting|Port|
|---|---|
|`mysql_public_addr`|`3036`|
|`postgres_public_addr`|`443`|
|`mongo_public_addr`|`443`|

</TabItem>
</Tabs>

## Do you support X database client?

Teleport relies on client certificates for authentication, so any database
client that supports this method of authentication and uses modern TLS (1.2+)
should work.

Standard command-line clients such as `psql`, `mysql`, `mongo` or `mongosh` are
supported. There are also instructions for configuring select
[graphical clients](../connect-your-client/gui-clients.mdx).

## When will you support X database?

We plan to support more databases in the future based on customer demand.

See if the database you're interested in has already been requested among
[GitHub issues](https://github.com/gravitational/teleport/labels/database-access)
or open a [new issue](https://github.com/gravitational/teleport/issues/new/choose)
to register your interest.

## Can I provide a custom CA certificate?

Yes, you can pass custom CA certificate by using a
[configuration file](./reference/configuration.mdx#database-service-configuration)
(look at `ca_cert_file`).

## Can I provide a custom DNS name for Teleport generated CA?

Yes, use `server_name` under the `tls` section in your Teleport configuration
file. Please look on our reference
[configuration file](./reference/configuration.mdx#database-service-configuration)
for more details.

## Can I disable CA verification when connecting to a database?

Yes, although it is not recommended. Certificate verification prevents
person-in-the-middle attacks and makes sure that you
are connected to the database that you intended to. 

Teleport also allows you to edit your
[configuration file](./reference/configuration.mdx#database-service-configuration)
to provide a custom CA certificate (`ca_cert_file`) or custom DNS name
(`server_name`), which is more secure. 

If none of the above options work for you and you still want to disable the CA
check, you can use `mode` under the `tls` option in the Teleport configuration file.

For more details please refer to the reference
[configuration file](./reference/configuration.mdx#database-service-configuration).