Which SSL settings win in DataGrip when the SSH/SSL tab and Advanced JDBC properties disagree?

Short answer

There is no formally documented precedence contract, but in practice the driver-level properties win. DataGrip translates the SSH/SSL tab fields into JDBC URL parameters or connection properties when the session opens, and the pgjdbc driver resolves the final URL itself. An explicit sslmode in the Advanced tab (or in a custom JDBC URL) is what the driver actually acts on. Treat this as well-established inferred behavior, not a guaranteed specification.

What that means for your two conflict cases

• GUI verification off + Advanced sslmode=verify-full: the Advanced value should win. verify-full enforces chain and hostname validation regardless of the checkbox state.
• GUI verification on + Advanced sslmode=require: the weaker mode governs. The GUI may still write sslrootcert, but with require the pgjdbc driver encrypts without validating the certificate chain or hostname. This is the dangerous direction: the GUI looks strict while the connection is not.

One more override to know about: a custom sslfactory property can silently bypass sslmode-based validation entirely in pgjdbc, so check Advanced for that too.

Seeing the effective settings

DataGrip builds the final JDBC URL from the General and SSL fields plus Advanced properties, and the URL field on the General tab updates as you edit. That generated URL is the closest thing to a merged property view the IDE exposes. Note that pg_stat_ssl and any "SSL enabled" indicator confirm encryption only — never validation — so they cannot answer your question.

Verifying instead of trusting

1. Set the conflict deliberately: GUI verification off, Advanced sslmode=verify-full and sslrootcert pointing at your CA.
2. Connect to a server whose certificate hostname does not match. verify-full must fail; if it connects, the Advanced value lost.
3. Point sslrootcert at a wrong or empty CA file. A genuinely verifying connection must fail; encryption-only modes will still succeed.
4. Copy the generated URL and connect with psql using the same sslmode/sslrootcert to confirm identical behavior outside DataGrip.

Stability across versions

Not guaranteed. DataGrip downloads and updates JDBC drivers independently of the IDE release, and duplicate-parameter merging between GUI-generated and Advanced properties is version-sensitive. The answer also does not transfer to other drivers — MySQL Connector/J uses different properties (sslMode, trustCertificateKeyStoreUrl) with its own resolution rules. Re-run the negative test above after any driver update; it takes minutes and is the only reliable evidence.

Recommendation

For strict validation, set sslmode=verify-full and sslrootcert explicitly in Advanced, leave the GUI toggle consistent with that intent, and prove it with the hostname-mismatch test. Never treat the checkbox or a successful connection as evidence of identity checking.