Subject: pgadmin says "SSL error: tlsv1 alert no application protocol"

From: Markus KARG <[email-masked]>
Date: Thu, 12 Dec 2024 20:08:20 +0100

I was using PGAdmin with PostgreSQL 17 via Traefik 3 successfully since 
many months, but since I recently moved on to PostgresSQL 17 the UI of 
PGAdmin always tells me "SSL error: tlsv1 alert no application 
protocol". All other applications connect successfully.

I do not want to use TLSv1, and neither PostgreSQL 17 nor Traefik 3 is 
explicitly configured to use TLS v1. In PGAdmin I explicitly have set 
the min and max SSL versions to 1.3.

So I do wonder who in this game is using TLSv1 and how to get rid of it?

Thanks!

-Markus

---

From: Adrian Klaver <[email-masked]>
Date: Thu, 12 Dec 2024 11:37:40 -0800

> So I do wonder who in this game is using TLSv1 and how to get rid of it?

This is the wrong list for this sort of question.

Ask it over here:

https://www.postgresql.org/list/pgsql-general/

-- 
Adrian Klaver
[email-masked]

---

From: Markus KARG <[email-masked]>
Date: Thu, 12 Dec 2024 22:18:51 +0100

Thanks!

-Markus

---

From: Markus KARG <[email-masked]>
Date: Fri, 13 Dec 2024 16:31:00 +0100

Could anybody please be so kind and help me with this issue? Thanks! :-)

Am 12.12.2024 um 22:18 schrieb Markus KARG:
> I was using PGAdmin with PostgreSQL 17 via Traefik 3 successfully 
> since many months, but since I recently moved on to PostgresSQL 17 the 
> UI of PGAdmin always tells me "SSL error: tlsv1 alert no application

---

From: Yogesh Mahajan <[email-masked]>
Date: Mon, 16 Dec 2024 10:25:21 +0530

Hi,

I guess an error is occurring while connecting to the server. Can
you please check and change SSL mode for server which is giving error to
'prefer'/'disabled'

Thanks,
Yogesh Mahajan
EnterpriseDB

---

From: Markus KARG <[email-masked]>
Date: Mon, 16 Dec 2024 13:46:35 +0100

Thank you for your kind help!

The good news first: I downgraded PGAdmin from 8.14 to *8.12 and 
everything is working well* then with the exact same configuration in 
the exact same environment!

The bad news: 8.13 and 8.14 both do have the described problem. 
Apparently something in PGAdmin changed from 8.12 to 8.13 that is 
causing this issue. As I could not find something in the release notes 
https://www.pgadmin.org/docs/pgadmin4/8.13/release_notes_8_13.html that 
would explain the observed behavior, I would say this is a bug.

Regarding your question: When switching "SSL mode" from "require" (which 
causes the message "SSL error: tlsv1 alert no application protocol") to 
"prefer" or "disabled", then PGAdmin is running into a connection 
timeout. That is no surprise, as the Traefik 3.2 proxy guards PostgreSQL 
17.2 server from all non-TLS traffic.

Any ideas? Shall I author a bug report? Do you like to perform tests in 
my environment?

-Markus

Am 16.12.2024 um 05:55 schrieb Yogesh Mahajan:
> you please check and change SSL mode for server which is giving error 
> to 'prefer'/'disabled'
>
> Screenshot 2024-12-16 at 10.23.59 AM.png
>
> Thanks,
> Yogesh Mahajan
> EnterpriseDB
>
>

---

From: Khushboo Vashi <[email-masked]>
Date: Mon, 16 Dec 2024 19:09:29 +0530

On Mon, Dec 16, 2024 at 6:16 PM Markus KARG <[email-masked]> wrote:

> everything is working well* then with the exact same configuration in the
> exact same environment!
>
Can you please share the OS details? If it is Linux, please share the
details of the Python version as well.

> The bad news: 8.13 and 8.14 both do have the described problem. Apparently
> something in PGAdmin changed from 8.12 to 8.13 that is causing this issue.
> As I could not find something in the release notes
> "prefer" or "disabled", then PGAdmin is running into a connection timeout.
> That is no surprise, as the Traefik 3.2 proxy guards PostgreSQL 17.2 server
> from all non-TLS traffic.
>
> Any ideas? Shall I author a bug report? Do you like to perform tests in my
> environment?
>
> -Markus
>
>

---

From: Surya Widyanto <[email-masked]>
Date: Mon, 16 Dec 2024 21:22:43 +0700

Hi,

Recently I've had the same problem when upgrading to v8.13 or v8.14 from 
v8.12, it broke my PgAdmin4 on windows and linux, on linux I run as 
Server Mode with Apache HTTPD, and on windows I also run local WebServer 
mode that I run on command prompt to be able to access it from 
http://localhost:5050/.

Basically what I've been identified the problem are with the library 
libpq that being used by PgAdmin4, in my case, I install several major 
version within the same machine, so I have difficulties identifying 
which version of libpq being used by PgAdmin4, and for the linux 
instance, the problem so severe that the instance cannot be accessed 
from web server and always give HTTP Errpr 500. But on windows instance, 
my problem is I cannot connect to a server with SSL Mode turned on 
(required or prefer)

But I found the way to overcome this problem by installing the pip 
package of psycopg_binary within the virtual environment of the PgAdmin4 
Python.

On Linux I run this command:

# Activate Virtual Environment
source <path_to_activate_script>
# e.g
source /usr/pgadmin4/venv/bin/activate

# Install PIP Package
pip install "psycopg[binary]"

# Deactivate/Exit Virtual Environment
deactivate

On Windows I run this command:

cd C:\Program Files\pgAdmin 4\python
python

 >>> import pip
 >>> [CTRL-Z + Enter]    # to exit python prompt

python -m pip install "psycopg[binary]"

And that's it, I can run my PgAdmin4 v8.13 or v8.14 instance without 
having to depend on external or system installed libpq library again.

Regards,
-ayrus02

On 16-12-2024 19:46, Markus KARG wrote:
> https://www.pgadmin.org/docs/pgadmin4/8.13/release_notes_8_13.html 
> that would explain the observed behavior, I would say this is a bug.
>
> Regarding your question: When switching "SSL mode" from "require" 
> (which causes the message "SSL error: tlsv1 alert no application 
> protocol") to "prefer" or "disabled", then PGAdmin is running into a 
> connection timeout. That is no surprise, as the Traefik 3.2 proxy 
> guards PostgreSQL 17.2 server from all non-TLS traffic.
>
> Any ideas? Shall I author a bug report? Do you like to perform tests 
> in my environment?
>
> -Markus
>
>

---

From: Markus KARG <[email-masked]>
Date: Mon, 16 Dec 2024 20:01:52 +0100

I have not selected the OS and Python version. I am using this image: 
https://hub.docker.com/layers/dpage/pgadmin4/8.14/images/sha256-1053696a89c887a2a3ee6b24a7e2614cf68227d30ff8304e61da20bc71d4dd50 

Am 16.12.2024 um 14:39 schrieb Khushboo Vashi:
>     everything is working well* then with the exact same configuration
>     in the exact same environment!
>
>     protocol") to "prefer" or "disabled", then PGAdmin is running into
>     a connection timeout. That is no surprise, as the Traefik 3.2
>     proxy guards PostgreSQL 17.2 server from all non-TLS traffic.
>
>     Any ideas? Shall I author a bug report? Do you like to perform
>     tests in my environment?
>
>     -Markus
>
>
>>     you please check and change SSL mode for server which is giving
>>     error to 'prefer'/'disabled'
>>

---

From: Markus KARG <[email-masked]>
Date: Wed, 18 Dec 2024 10:18:08 +0100

Dave, as it turns out that the reported problem is not caused by PGAdmin 
itself but from the dpage/pgadmin Docker Image in particular, I would 
kindly ask you to chime in here at this point of the discussion. Thanks! :-)

-Markus

Am 16.12.2024 um 20:01 schrieb Markus KARG:
>>     everything is working well* then with the exact same
>>     configuration in the exact same environment!
>>
>>     protocol") to "prefer" or "disabled", then PGAdmin is running
>>     into a connection timeout. That is no surprise, as the Traefik
>>     3.2 proxy guards PostgreSQL 17.2 server from all non-TLS traffic.
>>
>>>     I guess an error is occurring while connecting to the server.
>>>     Can you please check and change SSL mode for server which is
>>>     giving error to 'prefer'/'disabled'
>>>