{"record":{"id":"13c2c9fee118b44a","repo":"jackc/pgx","slug":"failed-to-parse-certificate-from-server-err","errorCode":null,"errorMessage":"failed to parse certificate from server: {err}","messagePattern":"failed to parse certificate from server: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pgconn/config.go","lineNumber":897,"sourceCode":"\tnextCase:\n\t\tfallthrough\n\tcase \"verify-ca\":\n\t\t// Don't perform the default certificate verification because it\n\t\t// will verify the hostname. Instead, verify the server's\n\t\t// certificate chain ourselves in VerifyPeerCertificate and\n\t\t// ignore the server name. This emulates libpq's verify-ca\n\t\t// behavior.\n\t\t//\n\t\t// See https://github.com/golang/go/issues/21971#issuecomment-332693931\n\t\t// and https://pkg.go.dev/crypto/tls?tab=doc#example-Config-VerifyPeerCertificate\n\t\t// for more info.\n\t\ttlsConfig.InsecureSkipVerify = true\n\t\ttlsConfig.VerifyPeerCertificate = func(certificates [][]byte, _ [][]*x509.Certificate) error {\n\t\t\tcerts := make([]*x509.Certificate, len(certificates))\n\t\t\tfor i, asn1Data := range certificates {\n\t\t\t\tcert, err := x509.ParseCertificate(asn1Data)\n\t\t\t\tif err != nil {\n\t\t\t\t\treturn errors.New(\"failed to parse certificate from server: \" + err.Error())\n\t\t\t\t}\n\t\t\t\tcerts[i] = cert\n\t\t\t}\n\n\t\t\t// Leave DNSName empty to skip hostname verification.\n\t\t\topts := x509.VerifyOptions{\n\t\t\t\tRoots:         tlsConfig.RootCAs,\n\t\t\t\tIntermediates: x509.NewCertPool(),\n\t\t\t}\n\t\t\t// Skip the first cert because it's the leaf. All others\n\t\t\t// are intermediates.\n\t\t\tfor _, cert := range certs[1:] {\n\t\t\t\topts.Intermediates.AddCert(cert)\n\t\t\t}\n\t\t\t_, err := certs[0].Verify(opts)\n\t\t\treturn err\n\t\t}\n\tcase \"verify-full\":","sourceCodeStart":879,"sourceCodeEnd":915,"githubUrl":"https://github.com/jackc/pgx/blob/ec1a0befd22592cffffdeeb0a50311b506372f4c/pgconn/config.go#L879-L915","documentation":"Returned inside the verify-ca TLS callback after crypto/tls handed the server's certificate chain to pgx and x509 certificate chain verification failed against the configured root CAs. The wrapper adds context around the underlying x509 error, which is chained via %w and remains inspectable with errors.As.","triggerScenarios":"Thrown at pgconn/config.go:897 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Check that the server's certificate is signed by a CA present in sslrootcert","Verify the server certificate has not expired","Inspect the wrapped x509.CertificateInvalidError/SystemRootsError for the precise reason"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"ec1a0befd22592cffffdeeb0a50311b506372f4c","analyzedAt":"2026-08-04T22:52:11.263Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}