{"id":"13c2c9fee118b44a","repo":"jackc/pgx","slug":"failed-to-parse-certificate-from-server-err","errorCode":null,"errorMessage":"failed to parse certificate from server: {err}","messagePattern":"failed to parse certificate from server: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pgconn/config.go","lineNumber":897,"sourceCode":"\tnextCase:\n\t\tfallthrough\n\tcase \"verify-ca\":\n\t\t// Don't perform the default certificate verification because it\n\t\t// will verify the hostname. Instead, verify the server's\n\t\t// certificate chain ourselves in VerifyPeerCertificate and\n\t\t// ignore the server name. This emulates libpq's verify-ca\n\t\t// behavior.\n\t\t//\n\t\t// See https://github.com/golang/go/issues/21971#issuecomment-332693931\n\t\t// and https://pkg.go.dev/crypto/tls?tab=doc#example-Config-VerifyPeerCertificate\n\t\t// for more info.\n\t\ttlsConfig.InsecureSkipVerify = true\n\t\ttlsConfig.VerifyPeerCertificate = func(certificates [][]byte, _ [][]*x509.Certificate) error {\n\t\t\tcerts := make([]*x509.Certificate, len(certificates))\n\t\t\tfor i, asn1Data := range certificates {\n\t\t\t\tcert, err := x509.ParseCertificate(asn1Data)\n\t\t\t\tif err != nil {\n\t\t\t\t\treturn errors.New(\"failed to parse certificate from server: \" + err.Error())\n\t\t\t\t}\n\t\t\t\tcerts[i] = cert\n\t\t\t}\n\n\t\t\t// Leave DNSName empty to skip hostname verification.\n\t\t\topts := x509.VerifyOptions{\n\t\t\t\tRoots:         tlsConfig.RootCAs,\n\t\t\t\tIntermediates: x509.NewCertPool(),\n\t\t\t}\n\t\t\t// Skip the first cert because it's the leaf. All others\n\t\t\t// are intermediates.\n\t\t\tfor _, cert := range certs[1:] {\n\t\t\t\topts.Intermediates.AddCert(cert)\n\t\t\t}\n\t\t\t_, err := certs[0].Verify(opts)\n\t\t\treturn err\n\t\t}\n\tcase \"verify-full\":","sourceCodeStart":879,"sourceCodeEnd":915,"githubUrl":"https://github.com/jackc/pgx/blob/ec1a0befd22592cffffdeeb0a50311b506372f4c/pgconn/config.go#L879-L915","documentation":"Error \"failed to parse certificate from server: {err}\" thrown in jackc/pgx.","triggerScenarios":"Thrown at pgconn/config.go:897 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":[],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"analyzedSha":"ec1a0befd22592cffffdeeb0a50311b506372f4c","analyzedAt":"2026-08-04T22:52:11.263Z","schemaVersion":2}