If you are using an external PostgreSQL instance instead of the one PE installs, there are some additional steps you'll need to take after installing PE to ensure SSL is correctly configured between PE and your PostgreSQL database.
Review the External PostgreSQL option and prep notes.
Copy PE SSL files to the PE PostgreSQL certs directory.
Note: Your external PostgreSQL instance should be 9.4.
Note: The following examples use $PGDATA for the PostgreSQL config directory. $PGDATA is typically /opt/puppetlabs/server/data/postgresql/9.4/data/.
Create a certs directory in $PGDATA.
Copy the the PE SSL cert and private key to the PostgreSQL certs directory.
a. Copy /etc/puppetlabs/puppet/ssl/certs/<POSTGRESQL HOSTNAME>.pem to $PGDATA/certs/<POSTGRESQL HOSTNAME>.cert.pem.
b. Copy /etc/puppetlabs/puppet/ssl/private_keys/<POSTGRESQL HOSTNAME>.pem to $PGDATA/certs/<POSTGRESQL HOSTNAME>.private_key.pem.
Make sure the file has no entry resembling ssl = off.
If there are any errors check your postgresql log file. Potential errors that might happen include certs/keys not being readable by PostgreSQL.
Note: If you are managing PostgreSQL with Puppet, make sure to add these SSL settings in your Puppet manifest instead of in postgresql.conf; otherwise, Puppet will remove the entries the next time it runs.
In the console, click Nodes > Classification, and select the PE Infrastructure node group.
On the Classes tab, find the class puppet_enterprise, and edit the database_ssl parameter to true.
Kick off a Puppet run on the Puppet master (for a monolithic install), or on the Puppet master, PE console, and PuppetDB nodes (in a split install).
On the Classes tab, find the class puppet_enterprise, and edit the database_ssl parameter and database_cert_auth parameter to true.
On the external PostgreSQL server, restart the PostgreSQL service.