Message-ID: <gh-pgjdbc-pgjdbc-3973@github.com>
From: "vlsi (@vlsi)" <noreply+vlsi@github.com>
To: "pgjdbc/pgjdbc" <noreply+pgjdbc-pgjdbc@github.com>
Date: Tue, 17 Mar 2026 17:44:10 +0000
Subject: [pgjdbc/pgjdbc] PR #3973: fix: retry with SSL on IOException when sslMode=ALLOW
List-Id: <gh-pgjdbc-pgjdbc.github.com>
X-GitHub-Author-Id: 213894
X-GitHub-Author-Login: vlsi
X-GitHub-Issue: 3973
X-GitHub-Labels: bug
X-GitHub-Repo: pgjdbc/pgjdbc
X-GitHub-State: merged
X-GitHub-Type: pull_request
X-GitHub-Url: https://github.com/pgjdbc/pgjdbc/pull/3973
Content-Type: text/plain; charset=utf-8

When `sslMode=ALLOW`, the driver tries plaintext first and upgrades to SSL if the server rejects the connection. On Windows, PostgreSQL may reset the connection (`IOException`) instead of sending a FATAL auth error (`SQLException` with `INVALID_AUTHORIZATION_SPECIFICATION`). This caused the `ALLOW` flow to fail instead of upgrading to SSL.

Extract `tryConnectWithSsl` helper (mirrors `tryConnectWithoutSsl`) and handle `IOException` for `ALLOW` in the same catch block as `PREFER`.