From: Tom Lane <tgl@sss.pgh.pa.us>
To: Axel Rau <Axel.Rau@chaos1.de>
cc: pgsql-admin@lists.postgresql.org
Subject: Re: SSL cert "not initialized" error with logical replication with
 13.11
In-reply-to: <F2AB0E5A-3FD7-40F5-A22B-01073F227AD7@Chaos1.DE>
References: <F2AB0E5A-3FD7-40F5-A22B-01073F227AD7@Chaos1.DE>
Comments: In-reply-to Axel Rau <Axel.Rau@chaos1.de>
	message dated "Wed, 21 Jun 2023 12:11:43 +0200"
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <3757320.1687355602.1@sss.pgh.pa.us>
Content-Transfer-Encoding: quoted-printable
Date: Wed, 21 Jun 2023 09:53:22 -0400
Message-ID: <3757321.1687355602@sss.pgh.pa.us>
Archived-At: 
 <https://www.postgresql.org/message-id/3757321.1687355602%40sss.pgh.pa.us>
Precedence: bulk

Axel Rau <Axel.Rau@chaos1.de> writes:
> After upgrading to 13.11, Publisher no longer accepts cert of subscriber=
.

The error is pretty clear:

> RROR,XX000,"could not connect to the publisher: SSL error: sslv3 alert c=
ertificate expired",,,,,,,,,"","logical replication worker"

> Servercert:
>             Not Before: Aug 18 09:12:35 2022 GMT
>             Not After : Aug 29 09:12:35 2023 GMT

How sure are you that that cert is the one the publisher is using?
Also, maybe the complaint is about a cert being used by the subscriber,
not the publisher?  I don't think this error message would distinguish
that.

			regards, tom lane