From: Tom Lane <tgl@sss.pgh.pa.us>
To: jian xu <jamesxu@outlook.com>
Cc: pgsql-admin <pgsql-admin@postgresql.org>
Subject: Re: pg13 psql can't connect pg instance with ssl enabled after upgrading
Date: Fri, 12 Feb 2021 16:50:23 -0500
Message-ID: <1608034.1613166623@sss.pgh.pa.us> (raw)
In-Reply-To: <BL0PR02MB456168A5C9909C71C578CFFDA18B9@BL0PR02MB4561.namprd02.prod.outlook.com>
References: <BL0PR02MB456168A5C9909C71C578CFFDA18B9@BL0PR02MB4561.namprd02.prod.outlook.com>
jian xu <jamesxu@outlook.com> writes:
> the instance didn't have ssl enabled, we upgraded it to pg13, then enabled ssl, however when we try to login with pg13 psql 13, psql always try ssl=off to login
> public_postgresql_13_1/bin/psql "sslmode=require host=xxxxxx dbname=postgres"
> psql: error: FATAL: no pg_hba.conf entry for host "xxxxx", user "xxxx", database "postgres", SSL off
Are you entirely sure that that version of psql (or more accurately,
the libpq it's linked to) was built with SSL support?
If you are in an environment where GSS encryption is possible, it
could also be that you're being bit by the recently-fixed bug that
libpq didn't fall back from GSS to SSL encryption correctly [1].
That seems unlikely though, as both client and server would need to
possess active Kerberos tickets.
regards, tom lane
[1] https://git.postgresql.org/gitweb/?p=postgresql.git&a=commitdiff&h=06b844c2b
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-admin@postgresql.org
Cc: tgl@sss.pgh.pa.us, jamesxu@outlook.com
Subject: Re: pg13 psql can't connect pg instance with ssl enabled after upgrading
In-Reply-To: <1608034.1613166623@sss.pgh.pa.us>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox