{"record":{"id":"41fb636106536624","repo":"risingwavelabs/risingwave","slug":"unable-to-setup-an-ssl-connection","errorCode":null,"errorMessage":"Unable to setup an SSL connection","messagePattern":"Unable to setup an SSL connection","errorType":"error_code","errorClass":"PsqlError","httpStatus":null,"severity":"error","filePath":"src/utils/pgwire/src/error.rs","lineNumber":81,"sourceCode":"    ),\n\n    #[error(transparent)]\n    IoError(#[from] IoError),\n\n    /// Uncategorized error for describe, bind.\n    #[error(transparent)]\n    Uncategorized(\n        #[from]\n        #[backtrace]\n        BoxedError,\n    ),\n\n    #[error(\"Panicked when handling the request: {0}\nThis is a bug. We would appreciate a bug report at:\n  https://github.com/risingwavelabs/risingwave/issues/new?labels=type%2Fbug&template=bug_report.yml\")]\n    Panic(String),\n\n    #[error(\"Unable to setup an SSL connection\")]\n    SslError(#[from] openssl::ssl::Error),\n\n    #[error(\"terminating connection due to idle-in-transaction timeout\")]\n    IdleInTxnTimeout,\n\n    #[error(\"Server throttled: {0}\")]\n    ServerThrottle(String),\n}\n\n#[derive(Debug)]\npub struct ProtocolViolationError(String);\n\nimpl fmt::Display for ProtocolViolationError {\n    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {\n        self.0.fmt(f)\n    }\n}\n","sourceCodeStart":63,"sourceCodeEnd":99,"githubUrl":"https://github.com/risingwavelabs/risingwave/blob/6469eb736d691e8e9b8a419a57edd6429ca77417/src/utils/pgwire/src/error.rs#L63-L99","documentation":"Pgwire failed to establish a TLS session using the openssl crate when the client requested SSL. This wraps an `openssl::ssl::Error` (handshake failure, certificate problem, protocol mismatch) under a fixed top-level message.","triggerScenarios":"Client sends an SSLRequest and the server's TLS handshake via openssl fails — e.g. mismatched TLS versions/ciphers, invalid server certificate/key, or mid-handshake IO failure.","commonSituations":"Misconfigured TLS cert/key paths on the server; clients requiring TLS versions the server's openssl build doesn't support; expired or self-signed certificates rejected during handshake.","solutions":["Check server TLS certificate and private key configuration (paths, validity, matching key pair).","Verify client and server support a common TLS version and cipher suite.","Inspect the inner openssl::ssl::Error (source) for the precise handshake stage failure.","As a stopgap, connect without SSL (`sslmode=disable`) while fixing TLS config."],"exampleFix":"// before: expired cert in config\nssl_cert = \"server_expired.crt\"\n// after: renewed cert\nssl_cert = \"server_renewed.crt\"","handlingStrategy":"validation","validationCode":"openssl x509 -in server.crt -noout -dates   # check validity\nopenssl rsa -in server.key -check -noout    # check key\nopenssl s_client -connect host:4566 -starttls postgres 2>/dev/null | head -5","typeGuard":null,"tryCatchPattern":"match err {\n    PsqlError::SslError(e) => eprintln!(\"TLS handshake failed: {}\", e),\n    other => return Err(other),\n}","preventionTips":["Automate certificate renewal before expiry.","Standardize minimum TLS versions across clients and server.","Test SSL connections in CI after any TLS config change."],"tags":["tls","ssl","handshake","openssl"],"backgroundTag":"http-request-failed","analyzedSha":"6469eb736d691e8e9b8a419a57edd6429ca77417","analyzedAt":"2026-09-11T21:06:21.487Z","contentChangedAt":"2026-09-11T21:06:21.487Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}