diff --git a/roles/serveur_icinga/defaults/main.yml b/roles/serveur_icinga/defaults/main.yml
index 5c547eb..724e1f8 100644
--- a/roles/serveur_icinga/defaults/main.yml
+++ b/roles/serveur_icinga/defaults/main.yml
@@ -26,3 +26,8 @@ serveur_icinga_redis_port: 6380
 
 serveur_icinga_config: "/etc/icingadb/config.yml"
 serveur_icinga_schema: "/usr/share/icingadb/schema/pgsql/schema.sql"
+
+# TLS vers PostgreSQL (zero-confiance). true = IcingaDB verifie le cert serveur
+# contre le root_ca step-ca (host dans le SAN). root_ca doit etre lisible (0644).
+serveur_icinga_db_tls: false
+serveur_icinga_db_ca: "/etc/step/certs/root_ca.crt"
diff --git a/roles/serveur_icinga/templates/config.yml.j2 b/roles/serveur_icinga/templates/config.yml.j2
index c2645a4..f61535e 100644
--- a/roles/serveur_icinga/templates/config.yml.j2
+++ b/roles/serveur_icinga/templates/config.yml.j2
@@ -5,6 +5,10 @@ database:
   database: {{ serveur_icinga_entree.base }}
   user: {{ serveur_icinga_entree.proprietaire }}
   password: {{ serveur_icinga_db_password }}
+{% if serveur_icinga_db_tls | default(false) %}
+  tls: true
+  ca: {{ serveur_icinga_db_ca }}
+{% endif %}
 
 redis:
   host: {{ serveur_icinga_redis_host }}