Received: from malur.postgresql.org ([217.196.149.56])
	by arkaria.postgresql.org with esmtps  (TLS1.3) tls
 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
	(Exim 4.96)
	(envelope-from <pgsql-bugs-owner+archive@lists.postgresql.org>)
	id 1wWZo0-002iBJ-2o
	for pgsql-bugs@arkaria.postgresql.org;
	Mon, 08 Jun 2026 13:14:17 +0000
Received: from localhost ([127.0.0.1] helo=malur.postgresql.org)
	by malur.postgresql.org with esmtp (Exim 4.96)
	(envelope-from <pgsql-bugs-owner+archive@lists.postgresql.org>)
	id 1wWZnz-002WqG-1Q
	for pgsql-bugs@arkaria.postgresql.org;
	Mon, 08 Jun 2026 13:14:15 +0000
Received: from magus.postgresql.org ([2a02:c0:301:0:ffff::29])
	by malur.postgresql.org with esmtps  (TLS1.3) tls
 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
	(Exim 4.96)
	(envelope-from <noreply@postgresql.org>)
	id 1wWYeI-002KJW-0M
	for pgsql-bugs@lists.postgresql.org;
	Mon, 08 Jun 2026 12:00:10 +0000
Received: from mahout.postgresql.org ([2001:4800:3e1:1::227])
	by magus.postgresql.org with esmtps  (TLS1.3) tls
 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
	(Exim 4.98.2)
	(envelope-from <noreply@postgresql.org>)
	id 1wWYeF-00000001xvr-1opb
	for pgsql-bugs@lists.postgresql.org;
	Mon, 08 Jun 2026 12:00:09 +0000
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;
	d=postgresql.org; s=20171124; h=Message-ID:Date:Reply-To:Cc:From:To:Subject:
	Content-Transfer-Encoding:MIME-Version:Content-Type:Sender:Content-ID:
	Content-Description:In-Reply-To:References;
	bh=a1SKlrLqLoZ1J1WSf69qmBT44+GFVnHccN8z35ojkSo=; b=HN6YXj5THQ/zaC5kVQuBhFIgmM
	qXe/PX9mmOYeyvd747OXi4JGEJ2JUSSpioeoEmtyFWuAK/G+f3Xoe0ZA7rvSEY9AcYpE6h3asAGfq
	kCPMX6ts44alk8enI2PDKhxSIVKl0jGVRiLNhOk/wpuDZGi3JibEC7ICDLLiStj6UELVYNaaXbp2c
	J1XtK5UTTCKLvJ3iALQp9cXAE5aIgVlzKkVRA8Nx5aLKQtmgcpa0ErSe8JxOeKiti5dA4P3ouyMrC
	FHskP0oAYC/agOJQmM2bwO09exEfJIalSthuNWuiZtrVIiZrICDt8mQlgSNiIZxphU8jvOdaunHBs
	xhGrqghw==;
Received: from wrigleys.postgresql.org ([2a02:16a8:dc51::60])
	by mahout.postgresql.org with esmtps  (TLS1.3) tls
 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
	(Exim 4.96)
	(envelope-from <noreply@postgresql.org>)
	id 1wWYeD-005Vfz-2u
	for pgsql-bugs@lists.postgresql.org;
	Mon, 08 Jun 2026 12:00:06 +0000
Received: from localhost ([127.0.0.1] helo=wrigleys.postgresql.org)
	by wrigleys.postgresql.org with esmtp (Exim 4.96)
	(envelope-from <noreply@postgresql.org>)
	id 1wWYeC-00CTko-1N
	for pgsql-bugs@lists.postgresql.org;
	Mon, 08 Jun 2026 12:00:04 +0000
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
Subject: BUG #19514: pg_hba error when configuring SSL Replication
To: pgsql-bugs@lists.postgresql.org
From: PG Bug reporting form <noreply@postgresql.org>
Cc: marijo.kristo@icloud.com
Reply-To: marijo.kristo@icloud.com, pgsql-bugs@lists.postgresql.org
Date: Mon, 08 Jun 2026 11:59:56 +0000
Message-ID: <19514-4be18364656609a4@postgresql.org>
X-Auto-Response-Suppress: All
Auto-Submitted: auto-generated
List-Id: <pgsql-bugs.lists.postgresql.org>
List-Help: <https://lists.postgresql.org/manage/>
List-Subscribe: <https://lists.postgresql.org/manage/>
List-Post: <mailto:pgsql-bugs@lists.postgresql.org>
List-Owner: <mailto:pgsql-bugs-owner@lists.postgresql.org>
List-Archive: <https://www.postgresql.org/list/pgsql-bugs>
Archived-At: 
 <https://www.postgresql.org/message-id/19514-4be18364656609a4%40postgresql.org>
Precedence: bulk

The following bug has been logged on the website:

Bug reference:      19514
Logged by:          Marijo Kristo
Email address:      marijo.kristo@icloud.com
PostgreSQL version: 18.4
Operating system:   Debian trixie
Description:       =20

Hello,

I have Barman installed on a seperate VM and I am trying to configure the
Postgres Server, which is behind a TLS SNI Aware Proxy.
Normal PSQL Connections are working, but I get an error message when I
configure barman with the following streaming_conn_info:

streaming_conninfo =3D host=3Dpgctest01-rw.dbms.development.cloud.internal
user=3Dpostgres dbname=3Dpostgres sslmode=3Drequire sslnegotiation=3Ddirect

 pg_hba:
   - hostssl all all 0.0.0.0/0 scram-sha-256
   - hostssl replication postgres 0.0.0.0/0 scram-sha-256

Error Message:
2026-06-08 13:51:48,496 [318870] barman.postgres WARNING: Error retrieving
PostgreSQL status: connection to server at
"pgctest01-rw.dbms.development.cloud.internal" (10.101.14.225), port 5432
failed: FATAL:  no pg_hba.conf entry for replication connection from host
"240.13.11.16", user "postgres", no encryption

When I adjust the pg_hba to following configuration I dont get any error
messages anymore and the connection seems to be encrypted when inspecting
the interface via tcpdump.
Can someone explain me why I am getting this error message even when I force
sslmode and sslnegotiation ?

pg_hba:
  - hostssl all all 0.0.0.0/0 scram-sha-256
  - host replication postgres 0.0.0.0/0 scram-sha-256

Best Regards
Marijo