{"record":{"id":"c658f85f32ffdeec","repo":"jackc/pgx","slug":"channel-binding-required-but-failed-to-get-server","errorCode":null,"errorMessage":"channel binding required but failed to get server certificate hash: %w","messagePattern":"channel binding required but failed to get server certificate hash: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pgconn/auth_scram.go","lineNumber":59,"sourceCode":"\n// Perform SCRAM authentication.\nfunc (c *PgConn) scramAuth(serverAuthMechanisms []string) error {\n\tsc, err := newScramClient(serverAuthMechanisms, c.config.Password)\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tserverHasPlus := slices.Contains(sc.serverAuthMechanisms, scramSHA256PlusName)\n\tif c.config.ChannelBinding == \"require\" && !serverHasPlus {\n\t\treturn errors.New(\"channel binding required but server does not support SCRAM-SHA-256-PLUS\")\n\t}\n\n\t// If we have a TLS connection and channel binding is not disabled, attempt to\n\t// extract the server certificate hash for tls-server-end-point channel binding.\n\tif tlsConn, ok := c.conn.(*tls.Conn); ok && c.config.ChannelBinding != \"disable\" {\n\t\tcertHash, err := getTLSCertificateHash(tlsConn)\n\t\tif err != nil && c.config.ChannelBinding == \"require\" {\n\t\t\treturn fmt.Errorf(\"channel binding required but failed to get server certificate hash: %w\", err)\n\t\t}\n\n\t\t// Upgrade to SCRAM-SHA-256-PLUS if we have binding data and the server supports it.\n\t\tif certHash != nil && serverHasPlus {\n\t\t\tsc.authMechanism = scramSHA256PlusName\n\t\t}\n\n\t\tsc.channelBindingData = certHash\n\t\tsc.hasTLS = true\n\t}\n\n\tif c.config.ChannelBinding == \"require\" && sc.channelBindingData == nil {\n\t\treturn errors.New(\"channel binding required but channel binding data is not available\")\n\t}\n\n\t// Send client-first-message in a SASLInitialResponse\n\tsaslInitialResponse := &pgproto3.SASLInitialResponse{\n\t\tAuthMechanism: sc.authMechanism,","sourceCodeStart":41,"sourceCodeEnd":77,"githubUrl":"https://github.com/jackc/pgx/blob/ec1a0befd22592cffffdeeb0a50311b506372f4c/pgconn/auth_scram.go#L41-L77","documentation":"SCRAM channel binding was requested (tls-server-end-point), but the client could not derive a hash of the server certificate — typically because the TLS connection state or certificate is unavailable. The wrapped error identifies the exact cause. The connection attempt is aborted since channel binding cannot proceed.","triggerScenarios":"Thrown at pgconn/auth_scram.go:59 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Check the wrapped error for the underlying TLS failure","Set ChannelBinding to \"disable\" if channel binding is not required","Ensure the connection is actually using TLS before requiring channel binding","Verify the server certificate uses a supported signature algorithm (see RFC 5929)"],"exampleFix":null,"handlingStrategy":"fallback","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"ec1a0befd22592cffffdeeb0a50311b506372f4c","analyzedAt":"2026-08-04T22:52:11.263Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}