{"record":{"id":"1482e3e3028682d5","repo":"jackc/pgx","slug":"tls-server-end-point-channel-binding-is-undefined","errorCode":null,"errorMessage":"tls-server-end-point channel binding is undefined for certificate signature algorithm %v","messagePattern":"tls-server-end-point channel binding is undefined for certificate signature algorithm (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pgconn/auth_scram.go","lineNumber":402,"sourceCode":"\tcert := state.PeerCertificates[0]\n\n\t// Per RFC 5929 section 4.1: If the certificate's signatureAlgorithm uses\n\t// MD5 or SHA-1, use SHA-256. Otherwise use the hash from the signature\n\t// algorithm.\n\t//\n\t// See: https://www.rfc-editor.org/rfc/rfc5929.html#section-4.1\n\tvar h hash.Hash\n\tswitch cert.SignatureAlgorithm {\n\tcase x509.MD5WithRSA, x509.SHA1WithRSA, x509.ECDSAWithSHA1:\n\t\th = sha256.New()\n\tcase x509.SHA256WithRSA, x509.SHA256WithRSAPSS, x509.ECDSAWithSHA256:\n\t\th = sha256.New()\n\tcase x509.SHA384WithRSA, x509.SHA384WithRSAPSS, x509.ECDSAWithSHA384:\n\t\th = sha512.New384()\n\tcase x509.SHA512WithRSA, x509.SHA512WithRSAPSS, x509.ECDSAWithSHA512:\n\t\th = sha512.New()\n\tdefault:\n\t\treturn nil, fmt.Errorf(\"tls-server-end-point channel binding is undefined for certificate signature algorithm %v\", cert.SignatureAlgorithm)\n\t}\n\n\th.Write(cert.Raw)\n\treturn h.Sum(nil), nil\n}\n","sourceCodeStart":384,"sourceCodeEnd":408,"githubUrl":"https://github.com/jackc/pgx/blob/ec1a0befd22592cffffdeeb0a50311b506372f4c/pgconn/auth_scram.go#L384-L408","documentation":"TLS channel binding (tls-server-end-point, RFC 5929) requires hashing the server certificate with an algorithm derived from its signature algorithm. The certificate uses a signature algorithm for which RFC 5929 defines no hash, so channel binding is impossible and the connection fails.","triggerScenarios":"Thrown at pgconn/auth_scram.go:402 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Reissue the server certificate with a standard signature algorithm (e.g. SHA-256 RSA or ECDSA)","Use a different channel binding type if the server supports it","Disable channel binding if the deployment allows","Verify the certificate chain is using modern algorithms"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"ec1a0befd22592cffffdeeb0a50311b506372f4c","analyzedAt":"2026-08-04T22:52:11.263Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}