[Yandex Cloud documentation](../../index.md) > [Yandex Managed Service for PostgreSQL](../index.md) > FAQ > Connection

# Connecting to a PostgreSQL cluster

* [Can I access the cluster from within Yandex Cloud?](#conn-from-yc)

* [Can I connect to the cluster from a Docker container?](#conn-from-docker)

* [How do I obtain an SSL certificate for connecting to Managed Service for PostgreSQL on Windows?](#get-ssl)

* [How do I install an SSL certificate to connect Power BI to Managed Service for PostgreSQL via psql?](#power-bi)

* [Can I connect to cluster hosts over SSH?](#connect-ssh)

* [What is the maximum allowed number of concurrent connections per host in Managed Service for PostgreSQL?](#host-conn)

* [What is the maximum allowed number of connections per user?](#user-conn)

* [Why am I getting an error when trying to connect to a database from Looker Studio?](#google-looker)

* [How to ensure I am always connecting to the master host?](#connect-to-master)

* [How to ensure I am always connecting to the most up-to-date replica?](#connect-to-replica)

* [How do I connect to the `postgres` database?](#postgres-db)

* [How do I get the `postgres` user password?](#postgres-user)

#### Can I access a cluster from within Yandex Cloud? {#conn-from-yc}

You can connect to Managed Service for PostgreSQL cluster hosts:
* Via the internet, if you configured public access for these hosts. You can only access such hosts over SSL.
* From Yandex Cloud virtual machines located in the same cloud network. For hosts without public access, SSL is not required to connect to them from these virtual machines.
* From a [Yandex Serverless Containers container](../../serverless-containers/concepts/index.md). For hosts without public access, this container must be located in the same cloud network.

For more information, see [this guide](../operations/connect/index.md).

#### Can I connect to a cluster from a Docker container? {#conn-from-docker}

Yes, you can. To do this, [configure the Dockerfile](../operations/connect/clients.md#connection-docker).

See a Yandex Serverless Containers container connection example in [this tutorial](../../serverless-containers/tutorials/pg-connect.md).

#### How do I obtain an SSL certificate for connecting to Managed Service for PostgreSQL on Windows? {#get-ssl}

You can obtain an SSL certificate using PowerShell:

```powershell
mkdir $HOME\.postgresql; curl.exe --output $HOME\.postgresql\root.crt https://storage.yandexcloud.net/cloud-certs/CA.pem
```

The certificate will be saved to the `$HOME\.postgresql\root.crt` file.

For details on getting a certificate and connecting to a database, see the [service guide](../operations/connect/index.md).

#### How do I install an SSL certificate to connect Power BI to Managed Service for PostgreSQL via psql? {#power-bi}

1. Install [Windows Subsystem for Linux](https://docs.microsoft.com/en-us/windows/wsl/) (WSL) and run the following command in the terminal:

   ```bash
   mkdir /mnt/c/temp && \
   curl "https://storage.yandexcloud.net/cloud-certs/CA.pem" --output /mnt/c/temp/CA.pem && \
   openssl pkcs12 -export -out /mnt/c/temp/CA.pfx -nokeys -in /mnt/c/temp/CA.pem
   ```

   The certificate will be located at `C:\temp\CA.pfx`.

1. [Install the obtained certificate in the Windows Certificate Store](https://docs.microsoft.com/en-us/skype-sdk/sdn/articles/installing-the-trusted-root-certificate).

#### Can I connect to cluster hosts over SSH? {#connect-ssh}

You cannot connect to hosts via SSH. This is done for the sake of security and user cluster fault tolerance because direct changes inside a host can render it completely inoperable.

#### What is the maximum allowed number of concurrent connections per host in Managed Service for PostgreSQL? {#host-conn}

The number of concurrent connections is configured at the cluster level using the [**Max connections** setting](../concepts/settings-list.md#setting-max-connections). By default it is set to the maximum value calculated using the following formula:

```text
200 × <number_of_vCPUs_per_host>
```

For instructions on updating PostgreSQL settings at the cluster level, see [this guide](../operations/update.md#change-postgresql-config).

#### What is the maximum allowed number of connections per user? {#user-conn}

By default, a cluster reserves 50 connections per host for each user. You can change this number in the [**Conn limit** setting](../concepts/settings-list.md#setting-conn-limit).

If the user’s connection limit is reached, new connection attempts will fail with the following error:

```text
too many active clients for user (pool_size for user <username> reached <limit_value>)
```

For instructions on updating PostgreSQL settings at the user level, see [this guide](../operations/cluster-users.md#update-settings).

#### Why am I getting an error when trying to connect to a database from Looker Studio? {#google-looker}

To connect from Looker Studio, you need to generate a client certificate file and a private key and specify them in the connection settings. For instructions, see [Connecting from Looker Studio](../operations/connect/clients.md#connection-google-looker).

#### How to ensure I am always connecting to the master host? {#connect-to-master}

To connect to the current master host, use a [special FQDN](../operations/connect/fqdn.md#special-fqdns) in the `c-<cluster_ID>.rw.mdb.yandexcloud.net` format. This FQDN supports read and write access.

{% cut "Example command for connecting to the master host" %}

  ```bash
  psql "host=c-<cluster_ID>.rw.mdb.yandexcloud.net \
        port=6432 \
        sslmode=verify-full \
        dbname=<DB_name> \
        user=<username>"
  ```

{% endcut %}

#### How to ensure I am always connecting to the most up-to-date replica? {#connect-to-replica}

To connect to the most up-to-date replica, use a [special FQDN](../operations/connect/fqdn.md#special-fqdns) in the `c-<cluster_ID>.ro.mdb.yandexcloud.net` format. This FQDN only supports read access. 

{% cut "Example command for connecting to a replica" %}

```bash
psql "host=c-<cluster_ID>.ro.mdb.yandexcloud.net \
      port=6432 \
      sslmode=verify-full \
      dbname=<DB_name> \
      user=<username>"
```

{% endcut %}

If there are no active replicas in the cluster, this FQDN will point to the current master host.

#### How do I connect to the `postgres` database? {#postgres-db}

`postgres` is a system database. For security reasons, you cannot connect to system databases.

#### How do I get the `postgres` user's password? {#postgres-user}

For security reasons, the system does not permit obtaining the `postgres` user's password to connect to the database on their behalf.