@@ -176,7 +176,7 @@ outside TOML and follow the same order:
   - SQL Server (NTLM): `sqlserver://user:password@localhost:1433/dbname?authentication=ntlm&domain=MYDOMAIN`
   - Oracle: `oracle://user:password@localhost:1521/FREEPDB1` (path is the service name; `?sid=ORCL` for a SID; `sslmode=require`/`verify-full` switch to TCPS)
   - SQLite: `sqlite:///path/to/database.db` or `sqlite:///:memory:`
-- SSL modes: `sslmode=disable` (no SSL), `sslmode=require` (SSL without cert verification), `sslmode=verify-ca` (PostgreSQL only, CA verification), `sslmode=verify-full` (PostgreSQL and Oracle, CA + hostname verification). Use `sslrootcert` to specify CA certificate path for verify modes.
+- SSL modes: `sslmode=disable` (no SSL), `sslmode=require` (SSL without cert verification), `sslmode=verify-ca` (PostgreSQL only, CA verification), `sslmode=verify-full` (PostgreSQL and Oracle, CA + hostname verification). Use `sslrootcert` to specify CA certificate path for verify modes. PostgreSQL client certificate auth: `sslcert` + `sslkey` (PEM, unencrypted, both required; `sslmode` must be `require`, `verify-ca` or `verify-full` — `disable` or unset is rejected) in the DSN or TOML source.
 
 ## Testing Approach
 
 
@@ -70,6 +70,20 @@ dsn = "postgres://postgres:postgres@localhost:5432/myapp"
 # sslmode = "verify-ca"
 # sslrootcert = "~/.ssl/rds-combined-ca-bundle.pem"
 
+# PostgreSQL with client certificate authentication (pg_hba.conf `hostssl ... cert`)
+# [[sources]]
+# id = "pg_client_cert"
+# type = "postgres"
+# host = "db.example.internal"
+# port = 5432
+# database = "app"
+# user = "app"
+# password = "${PG_PASSWORD}"
+# sslmode = "verify-ca"
+# sslrootcert = "~/.certs/ca.crt"
+# sslcert = "~/.certs/client.crt"
+# sslkey = "~/.certs/client.key"
+
 # Production PostgreSQL (behind SSH bastion, lazy connection)
 # [[sources]]
 # id = "prod_pg"
@@ -411,6 +425,8 @@ dsn = "postgres://postgres:postgres@localhost:5432/myapp"
 #   sslmode = "verify-ca"    # SSL with CA certificate verification (PostgreSQL only)
 #   sslmode = "verify-full"  # SSL with CA + hostname verification (PostgreSQL only)
 #   sslrootcert = "~/.ssl/ca.pem"  # CA certificate path (requires verify-ca or verify-full)
+#   sslcert = "~/.ssl/client.crt"  # PEM client certificate (PostgreSQL only; set with sslkey, needs sslmode require/verify-*)
+#   sslkey = "~/.ssl/client.key"   # Unencrypted PEM private key for sslcert (PostgreSQL only)
 #
 # SQL Server Authentication:
 #   authentication = "ntlm"                              # Windows/NTLM auth (requires domain)
 
@@ -254,6 +254,8 @@ This page covers command-line flags and environment variables. For TOML configur
   |-----------|-----------|-------------|---------|
   | `sslmode` | PostgreSQL, MySQL, MariaDB, SQL Server, Oracle | SSL mode: `disable`, `require`, `verify-ca`, `verify-full` | `?sslmode=require` |
   | `sslrootcert` | PostgreSQL | CA certificate path (requires `verify-ca` or `verify-full`) | `?sslrootcert=~/.ssl/ca.pem` |
+  | `sslcert` | PostgreSQL | PEM client certificate for client certificate authentication (set with `sslkey`; requires `require`, `verify-ca` or `verify-full`) | `?sslcert=~/.ssl/client.crt` |
+  | `sslkey` | PostgreSQL | Unencrypted PEM private key for `sslcert` | `?sslkey=~/.ssl/client.key` |
   | `instanceName` | SQL Server | Named instance | `?instanceName=SQLEXPRESS` |
   | `authentication` | SQL Server | Auth method: `ntlm`, `azure-active-directory-access-token` | `?authentication=ntlm` |
   | `domain` | SQL Server | Windows domain (with `authentication=ntlm`) | `?domain=CORP` |
@@ -280,6 +282,7 @@ This page covers command-line flags and environment variables. For TOML configur
   postgres://user:password@localhost:5432/dbname?sslmode=disable
   postgres://user:password@localhost:5432/dbname?sslmode=require
   postgres://user:password@rds-host:5432/dbname?sslmode=verify-ca&sslrootcert=~/.ssl/rds-ca.pem
+  postgres://user:password@pg-host:5432/dbname?sslmode=require&sslcert=~/.ssl/client.crt&sslkey=~/.ssl/client.key
   sqlserver://jsmith:secret@localhost:1433/mydb?authentication=ntlm&domain=CORP
   oracle://app:secret@db.example.com:2484/PROD?sslmode=verify-full
   ```
 
@@ -419,6 +419,46 @@ Sources define database connections. Each source represents a database that DBHu
   </Tip>
 </ParamField>
 
+### sslcert / sslkey
+
+<ParamField path="sslcert" type="string">
+  Path to a PEM client certificate for **client certificate authentication**. Use when the server enforces `hostssl ... cert` or `clientcert=verify-ca` / `verify-full` in `pg_hba.conf` and rejects connections with `connection requires a valid client certificate`.
+
+  Must be set together with `sslkey`, and requires `sslmode` to be `require`, `verify-ca` or `verify-full` (the certificate is only presented over TLS). It is independent of `sslrootcert`: `require` + `sslcert`/`sslkey` authenticates the client without verifying the server.
+
+  Supports `~/` path expansion.
+
+  **PostgreSQL only.**
+</ParamField>
+
+<ParamField path="sslkey" type="string">
+  Path to the PEM private key for `sslcert`. The key must be **unencrypted** (an encrypted key is rejected at startup; `sslpassword` is not supported). DER-encoded keys are not accepted.
+
+  Keep the key file private (`chmod 0600`); DBHub reads it once at startup and never logs its contents.
+
+  Supports `~/` path expansion.
+
+  **PostgreSQL only.**
+
+  ```toml
+  [[sources]]
+  id = "dev"
+  type = "postgres"
+  host = "db.example.internal"
+  database = "app"
+  user = "app"
+  password = "${PG_PASSWORD}"
+  sslmode = "verify-ca"
+  sslrootcert = "~/.certs/ca.crt"
+  sslcert = "~/.certs/client.crt"
+  sslkey = "~/.certs/client.key"
+  ```
+
+  <Tip>
+  Can also be set via DSN query parameters: `?sslmode=require&sslcert=/path/to/client.crt&sslkey=/path/to/client.key`
+  </Tip>
+</ParamField>
+
 ### instanceName
 
 <ParamField path="instanceName" type="string">
@@ -856,6 +896,8 @@ default = 10
 | `pool_max_connections` | integer | ❌ | PostgreSQL pool size per process and source (default: `10`, range: `1`-`1000`) |
 | `sslmode` | string | ❌ | SSL mode: `disable`, `require`, `verify-ca`, `verify-full` |
 | `sslrootcert` | string | ❌ | CA certificate path (PostgreSQL only, requires `verify-ca` or `verify-full`) |
+| `sslcert` | string | ❌ | PEM client certificate path for client certificate authentication (PostgreSQL only, requires `sslkey` and TLS enabled) |
+| `sslkey` | string | ❌ | Unencrypted PEM private key path for `sslcert` (PostgreSQL only) |
 | `instanceName` | string | ❌ | SQL Server named instance |
 | `authentication` | string | ❌ | SQL Server auth method |
 | `domain` | string | ❌ | Windows domain (NTLM) |
 
@@ -871,6 +871,190 @@ sslrootcert = "/nonexistent/ca.pem"
       });
     });
 
+    describe('client certificate (sslcert/sslkey) validation', () => {
+      let certPath: string;
+      let keyPath: string;
+
+      beforeEach(() => {
+        certPath = path.join(tempDir, 'client.crt');
+        keyPath = path.join(tempDir, 'client.key');
+        fs.writeFileSync(certPath, 'cert-content');
+        fs.writeFileSync(keyPath, 'key-content');
+      });
+
+      const writeSource = (extra: string, type = 'postgres'): void => {
+        fs.writeFileSync(
+          path.join(tempDir, 'dbhub.toml'),
+          `
+[[sources]]
+id = "test_db"
+type = "${type}"
+host = "localhost"
+database = "testdb"
+user = "user"
+password = "pass"
+${extra}
+`
+        );
+      };
+
+      it.each(['require', 'verify-ca', 'verify-full'])(
+        'should accept sslcert + sslkey with sslmode = "%s"',
+        (sslmode) => {
+          writeSource(`sslmode = "${sslmode}"\nsslcert = '${certPath}'\nsslkey = '${keyPath}'`);
+
+          const result = loadTomlConfig();
+
+          expect(result?.sources[0].sslcert).toBe(certPath);
+          expect(result?.sources[0].sslkey).toBe(keyPath);
+          expect(buildDSNFromSource(result!.sources[0])).toBe(
+            `postgres://user:pass@localhost:5432/testdb?sslmode=${sslmode}` +
+              `&sslcert=${encodeURIComponent(certPath)}&sslkey=${encodeURIComponent(keyPath)}`
+          );
+        }
+      );
+
+      it('should accept sslcert + sslkey together with sslrootcert', () => {
+        const caPath = path.join(tempDir, 'ca.pem');
+        fs.writeFileSync(caPath, 'ca-content');
+        writeSource(
+          `sslmode = "verify-full"\nsslrootcert = '${caPath}'\nsslcert = '${certPath}'\nsslkey = '${keyPath}'`
+        );
+
+        const result = loadTomlConfig();
+
+        expect(buildDSNFromSource(result!.sources[0])).toBe(
+          `postgres://user:pass@localhost:5432/testdb?sslmode=verify-full` +
+            `&sslrootcert=${encodeURIComponent(caPath)}` +
+            `&sslcert=${encodeURIComponent(certPath)}&sslkey=${encodeURIComponent(keyPath)}`
+        );
+      });
+
+      // expandHomeDir binds os.homedir at import time, so a spy cannot redirect
+      // it; write the fixtures under the real home directory instead.
+      const withHomeCerts = (fn: (relDir: string, homeCert: string, homeKey: string) => void): void => {
+        const relDir = `.dbhub-test-${process.pid}-${Date.now()}`;
+        const absDir = path.join(os.homedir(), relDir);
+        fs.mkdirSync(absDir, { recursive: true });
+        try {
+          fs.writeFileSync(path.join(absDir, 'client.crt'), 'cert');
+          fs.writeFileSync(path.join(absDir, 'client.key'), 'key');
+          fn(relDir, path.join(absDir, 'client.crt'), path.join(absDir, 'client.key'));
+        } finally {
+          fs.rmSync(absDir, { recursive: true, force: true });
+        }
+      };
+
+      it('should expand ~ in sslcert and sslkey', () => {
+        withHomeCerts((relDir, homeCert, homeKey) => {
+          writeSource(`sslmode = "require"\nsslcert = "~/${relDir}/client.crt"\nsslkey = "~/${relDir}/client.key"`);
+
+          const result = loadTomlConfig();
+
+          expect(result?.sources[0].sslcert).toBe(homeCert);
+          expect(result?.sources[0].sslkey).toBe(homeKey);
+        });
+      });
+
+      it('should reject sslcert/sslkey for non-PostgreSQL sources', () => {
+        writeSource(`sslmode = "require"\nsslcert = '${certPath}'\nsslkey = '${keyPath}'`, 'mysql');
+
+        expect(() => loadTomlConfig()).toThrow('sslcert/sslkey but they are only supported for PostgreSQL');
+      });
+
+      it('should reject sslcert without sslkey', () => {
+        writeSource(`sslmode = "require"\nsslcert = '${certPath}'`);
+
+        expect(() => loadTomlConfig()).toThrow('has sslcert without sslkey');
+      });
+
+      it('should reject sslkey without sslcert', () => {
+        writeSource(`sslmode = "require"\nsslkey = '${keyPath}'`);
+
+        expect(() => loadTomlConfig()).toThrow('has sslkey without sslcert');
+      });
+
+      it('should reject sslcert/sslkey when sslmode = "disable"', () => {
+        writeSource(`sslmode = "disable"\nsslcert = '${certPath}'\nsslkey = '${keyPath}'`);
+
+        expect(() => loadTomlConfig()).toThrow(
+          "sslcert/sslkey but sslmode is 'disable'. sslcert/sslkey require sslmode 'require', 'verify-ca' or 'verify-full'"
+        );
+      });
+
+      it('should reject sslcert/sslkey when sslmode is not set', () => {
+        writeSource(`sslcert = '${certPath}'\nsslkey = '${keyPath}'`);
+
+        expect(() => loadTomlConfig()).toThrow("sslcert/sslkey but sslmode is 'not set'");
+      });
+
+      it('should reject sslkey when the file does not exist', () => {
+        writeSource(`sslmode = "require"\nsslcert = '${certPath}'\nsslkey = "/nonexistent/client.key"`);
+
+        expect(() => loadTomlConfig()).toThrow(
+          "sslkey file not found or not accessible: '/nonexistent/client.key'"
+        );
+      });
+
+      it('should reject sslcert when the path is a directory', () => {
+        writeSource(`sslmode = "require"\nsslcert = '${tempDir}'\nsslkey = '${keyPath}'`);
+
+        expect(() => loadTomlConfig()).toThrow(`sslcert path is not a regular file: '${tempDir}'`);
+      });
+
+      it('should populate sslcert and sslkey fields from DSN query parameters', () => {
+        fs.writeFileSync(
+          path.join(tempDir, 'dbhub.toml'),
+          `
+[[sources]]
+id = "test_db"
+dsn = "postgres://user:pass@localhost:5432/db?sslmode=require&sslcert=${encodeURIComponent(certPath)}&sslkey=${encodeURIComponent(keyPath)}"
+`
+        );
+
+        const result = loadTomlConfig();
+
+        expect(result?.sources[0].sslcert).toBe(certPath);
+        expect(result?.sources[0].sslkey).toBe(keyPath);
+      });
+
+      it('should reject a sslcert field that conflicts with the DSN', () => {
+        const otherCert = path.join(tempDir, 'other.crt');
+        fs.writeFileSync(otherCert, 'other');
+        fs.writeFileSync(
+          path.join(tempDir, 'dbhub.toml'),
+          `
+[[sources]]
+id = "test_db"
+dsn = "postgres://user:pass@localhost:5432/db?sslmode=require&sslcert=${encodeURIComponent(otherCert)}&sslkey=${encodeURIComponent(keyPath)}"
+sslcert = '${certPath}'
+sslkey = '${keyPath}'
+`
+        );
+
+        expect(() => loadTomlConfig()).toThrow('conflicting sslcert');
+      });
+
+      it('should accept a sslkey field that matches the DSN after ~ expansion', () => {
+        withHomeCerts((relDir, homeCert, homeKey) => {
+          fs.writeFileSync(
+            path.join(tempDir, 'dbhub.toml'),
+            `
+[[sources]]
+id = "test_db"
+dsn = "postgres://user:pass@localhost:5432/db?sslmode=require&sslcert=${encodeURIComponent(homeCert)}&sslkey=${encodeURIComponent(homeKey)}"
+sslcert = "~/${relDir}/client.crt"
+sslkey = "~/${relDir}/client.key"
+`
+          );
+
+          const result = loadTomlConfig();
+
+          expect(result?.sources[0].sslkey).toBe(homeKey);
+        });
+      });
+    });
+
     describe('SQL Server authentication validation', () => {
       it('should accept authentication = "ntlm" with domain', () => {
         const tomlContent = `
@@ -1613,6 +1797,51 @@ collation = "utf8mb4_0900_ai_ci"
       );
     });
 
+    it('should merge sslcert and sslkey fields into a postgres DSN for require', () => {
+      const source: SourceConfig = {
+        id: 'test',
+        type: 'postgres',
+        dsn: 'postgres://user:pass@localhost:5432/db',
+        sslmode: 'require',
+        sslcert: '/etc/ssl/client cert.crt',
+        sslkey: '/etc/ssl/client.key',
+      };
+
+      const dsn = buildDSNFromSource(source);
+
+      expect(dsn).toBe(
+        'postgres://user:pass@localhost:5432/db?sslmode=require&sslcert=' +
+          encodeURIComponent('/etc/ssl/client cert.crt') +
+          '&sslkey=' +
+          encodeURIComponent('/etc/ssl/client.key')
+      );
+    });
+
+    it('should not duplicate sslcert/sslkey already present in the DSN', () => {
+      const source: SourceConfig = {
+        id: 'test',
+        type: 'postgres',
+        dsn: 'postgres://user:pass@localhost:5432/db?sslmode=require&sslcert=%2Fc.crt&sslkey=%2Fc.key',
+        sslcert: '/c.crt',
+        sslkey: '/c.key',
+      };
+
+      expect(buildDSNFromSource(source)).toBe(source.dsn);
+    });
+
+    it('should not merge sslcert/sslkey when sslmode is disable', () => {
+      const source: SourceConfig = {
+        id: 'test',
+        type: 'postgres',
+        dsn: 'postgres://user:pass@localhost:5432/db',
+        sslmode: 'disable',
+        sslcert: '/c.crt',
+        sslkey: '/c.key',
+      };
+
+      expect(buildDSNFromSource(source)).toBe('postgres://user:pass@localhost:5432/db?sslmode=disable');
+    });
+
     it('should not merge sslrootcert when sslmode is not a verify mode', () => {
       const source: SourceConfig = {
         id: 'test',