I've had a quick glance through the man page for pg_basebackup but can't see any flags to set ssl. Long story short, I've got the following in pg_hba.conf of the master: hostssl replication all 10.0.0.0/8 md5 But the slave is complaining: FATAL: no pg_hba.conf entry for replication connection from host "10.1.2.3", user "myrepl", no encryption I suspect this is almost certainly because I'm using "hostssl" instead of "host". But other than the obvious and undesirable quick-fix, how should I be calling pg_basebackup to make sure it uses encryption ?