Why would I download CA certificate when starting a managed Postgres cluster on DigitalOcean? I am trying for the first time a Postgres cluster provided as a managed service by DigitalOcean.com.
As part of configuring the new cluster, their web interface gives me a user name, password, port number and such. On that web page is a tiny link saying Download the CA certificate. I assume CA means Certificate Authority.
➥ Why would I use or not use that link to download the certificate?
When I click the link, I end up with a file on my machine named ca-certificate.crt. How would I use this file?
You can use it with TLS to verify that you are connecting to the correct server.
The connection string for that would look like:
host=... port=... dbname=... user=... sslmode=verify-full sslrootcert=/path/to/ca-certificate.crt

If you cannot specify the connection string that way, you can use the environment variables PGSSLMODE and PGSSLROOTCERT.
Then the PostgreSQL client library will verify that the server's certificate is actually signed by the CA certificate and that the server name is correct.
Of course that requires that your PostgreSQL client library was configured --with-openssl.