{"record":{"id":"b300bb24a60088d3","repo":"jackc/pgx","slug":"server-refused-tls-connection","errorCode":null,"errorMessage":"server refused TLS connection","messagePattern":"server refused TLS connection","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pgconn/pgconn.go","lineNumber":553,"sourceCode":"\t\t\tpgConn.conn.Close()\n\t\t\treturn nil, newPerDialConnectError(\"received unexpected message\", err)\n\t\t}\n\t}\n}\n\nfunc startTLS(conn net.Conn, tlsConfig *tls.Config) (net.Conn, error) {\n\terr := binary.Write(conn, binary.BigEndian, []int32{8, 80877103})\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tresponse := make([]byte, 1)\n\tif _, err = io.ReadFull(conn, response); err != nil {\n\t\treturn nil, err\n\t}\n\n\tif response[0] != 'S' {\n\t\treturn nil, errors.New(\"server refused TLS connection\")\n\t}\n\n\treturn tls.Client(conn, tlsConfig), nil\n}\n\nfunc (pgConn *PgConn) txPasswordMessage(password string) (err error) {\n\tpgConn.frontend.Send(&pgproto3.PasswordMessage{Password: password})\n\treturn pgConn.flushWithPotentialWriteReadDeadlock()\n}\n\nfunc hexMD5(s string) string {\n\thash := md5.New()\n\tio.WriteString(hash, s)\n\treturn hex.EncodeToString(hash.Sum(nil))\n}\n\nfunc (pgConn *PgConn) signalMessage() chan struct{} {\n\tif pgConn.bufferingReceive {","sourceCodeStart":535,"sourceCodeEnd":571,"githubUrl":"https://github.com/jackc/pgx/blob/ec1a0befd22592cffffdeeb0a50311b506372f4c/pgconn/pgconn.go#L535-L571","documentation":"During connection establishment pgx sent the SSLRequest startup packet, but the server answered with a byte other than 'S', meaning TLS is not enabled (or not supported) on that endpoint. The server's TLS configuration is the faulty input; this fires when sslmode demanded TLS the server cannot provide.","triggerScenarios":"Thrown at pgconn/pgconn.go:553 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Enable TLS on the PostgreSQL server (ssl=on with a valid certificate)","Relax sslmode to 'prefer' or 'disable' if encrypted connections are not required","Check that a TLS-terminating proxy in front of PostgreSQL is correctly configured"],"exampleFix":null,"handlingStrategy":"fallback","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"ec1a0befd22592cffffdeeb0a50311b506372f4c","analyzedAt":"2026-08-04T22:52:11.263Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}