Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1pvzM6-0007gv-Gb for pgsql-admin@arkaria.postgresql.org; Mon, 08 May 2023 11:48:38 +0000 Received: from localhost ([127.0.0.1] helo=malur.postgresql.org) by malur.postgresql.org with esmtp (Exim 4.92) (envelope-from ) id 1pvzM3-0005Df-Rt for pgsql-admin@arkaria.postgresql.org; Mon, 08 May 2023 11:48:35 +0000 Received: from magus.postgresql.org ([2a02:c0:301:0:ffff::29]) by malur.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1pvzM3-0005DV-H4 for pgsql-admin@lists.postgresql.org; Mon, 08 May 2023 11:48:35 +0000 Received: from jakobs.com ([85.214.83.89] helo=rs.plausibolo.de) by magus.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1pvzM1-001MIf-AU for pgsql-admin@lists.postgresql.org; Mon, 08 May 2023 11:48:34 +0000 Received: from localhost (localhost [127.0.0.1]) by rs.plausibolo.de (Postfix) with ESMTP id 70C3B380401; Mon, 8 May 2023 13:48:32 +0200 (CEST) Received: from rs.plausibolo.de ([IPv6:::1]) by localhost (h2367442.stratoserver.net [IPv6:::1]) (amavisd-new, port 10024) with ESMTP id JeQ5QSXQqR4J; Mon, 8 May 2023 13:48:32 +0200 (CEST) Received: from [192.168.186.86] (dynamic-046-114-159-201.46.114.pool.telefonica.de [46.114.159.201]) by rs.plausibolo.de (Postfix) with ESMTPSA id D88BC3803A0; Mon, 8 May 2023 13:48:31 +0200 (CEST) Message-ID: <9c9337f9-4e4b-fcf4-fd34-98461b686888@jakobs.com> Date: Mon, 8 May 2023 13:48:30 +0200 MIME-Version: 1.0 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Thunderbird/102.10.0 To: pgsql-admin@lists.postgresql.org References: Content-Language: de-DE From: Holger Jakobs Subject: Re: unknown postgres ssl error "could not accept SSL connection: Success" and timeout In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="------------wxvCiSdUU8Tfl0qPCB6YCmYN" List-Id: List-Help: List-Subscribe: List-Post: List-Owner: List-Archive: Archived-At: Precedence: bulk This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --------------wxvCiSdUU8Tfl0qPCB6YCmYN Content-Type: multipart/mixed; boundary="------------wh0T9qksdgqvOH5djJ60Xh5e"; protected-headers="v1" From: Holger Jakobs To: pgsql-admin@lists.postgresql.org Message-ID: <9c9337f9-4e4b-fcf4-fd34-98461b686888@jakobs.com> Subject: Re: unknown postgres ssl error "could not accept SSL connection: Success" and timeout References: In-Reply-To: --------------wh0T9qksdgqvOH5djJ60Xh5e Content-Type: multipart/alternative; boundary="------------TCXXT4DqGAmKRGmljS7cwJ4b" --------------TCXXT4DqGAmKRGmljS7cwJ4b Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: base64 QW0gMDguMDUuMjMgdW0gMTI6MTcgc2NocmllYiBCYXJqZXNoIFZhc2hpc3Q6DQo+IEhpIFNl cmdleSwNCj4NCj4gUGxlYXNlIGVuc3VyZSB0aGUgcGdfaGJhLmNvbmYgaGFzIGVuYWJsZWQg dGhlIFNTTC4NCj4gRWcuDQo+IHxob3N0c3NsIGFsbCBhbGwgMC4wLjAuMC8wIG1kNXwNCj4N Ckl0J3Mgbm90IG5lY2Vzc2FyeSB0byB1c2UgaG9zdHNzbCByZWNvcmRzLCBob3N0IHJlY29y ZHMgd2lsbCBkbyBhcyB3ZWxsLiANCkluIGFuIFNTTCBlbnZpcm9ubWVudCwgaG9zdHNzbCBt YWtlcyBzZW5zZSwgdGhvdWdoLiBCdXQgaXQgZG9lc24ndCBoZWxwIA0KaW4gdHJhY2tpbmcg ZG93biB0aGUgcHJvYmxlbS4NCg0KQnV0IC0gaWYgeW91ciB2ZXJzaW9uIHN1cHBvcnRzIGl0 IC0gdXNlIHNjcmFtLXNoYS0yNTYgYW5kIG5vdCBtZDUuDQoNCkFuZCBkb24ndCBhbGxvdyBh Y2Nlc3MgdG8gYWxsIGRhdGFiYXNlcyBieSBhbGwgdXNlcnMgZnJvbSBhbnkgSVAgYWRkcmVz cy4NCg0KRm9yIHRlc3RpbmcgcHVycG9zZXMgdGhpcyBtYXkgb2ssIGJ1dCBub3QgaW4gcmVh bCBsaWZlLg0KDQpJZiBwZ19oYmEgc2V0dGluZ3Mgd2VyZSB0aGUgcHJvYmxlbSwgdGhleSB3 b3VsZCBzaG93IHVwIGNsZWFybHkgYXMgc3VjaCANCmluIHRoZSBsb2csIGJ1dCB0aGF0J3Mg b2Jpdm91c2x5IG5vdCB0aGUgY2FzZS4NCg0KUmVnYXJkcywNCg0KSG9sZ2VyDQoNCg0KLS0g DQpIb2xnZXIgSmFrb2JzLCBCZXJnaXNjaCBHbGFkYmFjaCwgVGVsLiArNDktMTc4LTk3NTkw MTINCg0K --------------TCXXT4DqGAmKRGmljS7cwJ4b Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
Am 08.05.23 um 12:17 schrieb Barjesh Vashist:
Hi Sergey,

Please ensure the=C2=A0pg_hba.conf has enabled the SSL.
Eg.
 
hostssl	 all         all          0.0.0.0/0    		md5

It's not necessary to use hostssl records, host records will do as well. In an SSL environment, hostssl makes sense, though. But it doesn't help in tracking down the problem.

But - if your version supports it - use scram-sha-256 and not md5.

And don't allow access to all databases by all users from any IP address.

For testing purposes this may ok, but not in real life.

If pg_hba settings were the problem, they would show up clearly as such in the log, but that's obivously not the case.

Regards,

Holger


--=20
Holger Jakobs, Bergisch Gladbach, Tel. +49-178-9759012
--------------TCXXT4DqGAmKRGmljS7cwJ4b-- --------------wh0T9qksdgqvOH5djJ60Xh5e-- --------------wxvCiSdUU8Tfl0qPCB6YCmYN Content-Type: application/pgp-signature; name="OpenPGP_signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="OpenPGP_signature" -----BEGIN PGP SIGNATURE----- wmMEABEIACMWIQScuJCxWJK1p5BOebGKV5yTsxlhugUCZFjhjgUDAAAAAAAKCRCKV5yTsxlhuhY+ AJ4/gNHF0CkTVvaRGhG5O8Jbe6XFjwCfZytbJojv0FnGA9hJqXTTtnYmFUE= =qlwX -----END PGP SIGNATURE----- --------------wxvCiSdUU8Tfl0qPCB6YCmYN--