From: Tom Lane <tgl@sss.pgh.pa.us>
To: jian xu <jamesxu@outlook.com>
cc: pgsql-admin <pgsql-admin@postgresql.org>
Subject: Re: pg13 psql can't connect pg instance with ssl enabled after
 upgrading
In-reply-to: 
 <BL0PR02MB456168A5C9909C71C578CFFDA18B9@BL0PR02MB4561.namprd02.prod.outlook.com>
References: 
 <BL0PR02MB456168A5C9909C71C578CFFDA18B9@BL0PR02MB4561.namprd02.prod.outlook.com>
Comments: In-reply-to jian xu <jamesxu@outlook.com>
	message dated "Fri, 12 Feb 2021 21:16:23 +0000"
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <1608033.1613166623.1@sss.pgh.pa.us>
Content-Transfer-Encoding: quoted-printable
Date: Fri, 12 Feb 2021 16:50:23 -0500
Message-ID: <1608034.1613166623@sss.pgh.pa.us>
Precedence: bulk

jian xu <jamesxu@outlook.com> writes:
> the instance didn't have ssl enabled, we upgraded it to pg13, then enabl=
ed ssl, however when we try to login with pg13 psql 13, psql  always try s=
sl=3Doff to login
> public_postgresql_13_1/bin/psql "sslmode=3Drequire host=3Dxxxxxx dbname=3D=
postgres"
> psql: error: FATAL:  no pg_hba.conf entry for host "xxxxx", user "xxxx",=
 database "postgres", SSL off

Are you entirely sure that that version of psql (or more accurately,
the libpq it's linked to) was built with SSL support?

If you are in an environment where GSS encryption is possible, it
could also be that you're being bit by the recently-fixed bug that
libpq didn't fall back from GSS to SSL encryption correctly [1].
That seems unlikely though, as both client and server would need to
possess active Kerberos tickets.

			regards, tom lane

[1] https://git.postgresql.org/gitweb/?p=3Dpostgresql.git&a=3Dcommitdiff&h=
=3D06b844c2b