SSH tunnels and your own certificates

Connect a database in a private network through your bastion host, and use your own certificate authority and client certificates.

A database Halo can't reach directly can now connect through a bastion host, for PostgreSQL, and for Redshift and Dremio where Halo has turned them on for your organization. Add your organization's public key to the bastion, or give Halo a key of your own, and confirm the bastion's host key the first time. If that key ever changes, the connection stops until someone confirms it. See SSH tunnels.

Under TLS certificates, a connection can also check your database against your own certificate authority, and send a client certificate to PostgreSQL or Redshift. See TLS.

Fixed outbound IP addresses to allow in a firewall are still planned.