{"id":"606d6a69b912f053","repo":"brianc/node-postgres","slug":"invalid-sslnegotiation-value-this-sslnegotiati","errorCode":null,"errorMessage":"Invalid sslnegotiation value: \"${this.sslnegotiation}\". Valid values are \"postgres\" and \"direct\".","messagePattern":"Invalid sslnegotiation value: \"(.+?)\"\\. Valid values are \"postgres\" and \"direct\"\\.","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/pg/lib/connection-parameters.js","lineNumber":106,"sourceCode":"      if (this.ssl === 'true') {\n        this.ssl = true\n      }\n    }\n    // support passing in ssl=no-verify via connection string\n    if (this.ssl === 'no-verify') {\n      this.ssl = { rejectUnauthorized: false }\n    }\n    if (this.ssl && this.ssl.key) {\n      Object.defineProperty(this.ssl, 'key', {\n        enumerable: false,\n      })\n    }\n\n    // How to negotiate SSL: 'postgres' (default, the traditional SSLRequest\n    // handshake) or 'direct' (start the TLS handshake immediately on connect).\n    this.sslnegotiation = val('sslnegotiation', config, 'PGSSLNEGOTIATION')\n    if (this.sslnegotiation !== undefined && this.sslnegotiation !== 'postgres' && this.sslnegotiation !== 'direct') {\n      throw new Error(\n        `Invalid sslnegotiation value: \"${this.sslnegotiation}\". Valid values are \"postgres\" and \"direct\".`\n      )\n    }\n    if (this.sslnegotiation === 'direct' && !this.ssl) {\n      throw new Error('sslnegotiation=direct requires SSL to be enabled')\n    }\n\n    this.client_encoding = val('client_encoding', config)\n    this.replication = val('replication', config)\n    // a domain socket begins with '/'\n    this.isDomainSocket = !(this.host || '').indexOf('/')\n\n    this.application_name = val('application_name', config, 'PGAPPNAME')\n    this.fallback_application_name = val('fallback_application_name', config, false)\n    this.statement_timeout = val('statement_timeout', config, false)\n    this.lock_timeout = val('lock_timeout', config, false)\n    this.idle_in_transaction_session_timeout = val('idle_in_transaction_session_timeout', config, false)\n    this.query_timeout = val('query_timeout', config, false)","sourceCodeStart":88,"sourceCodeEnd":124,"githubUrl":"https://github.com/brianc/node-postgres/blob/c5e8c9a57bff6d9160ec5dbd5c4f4c1e4c460711/packages/pg/lib/connection-parameters.js#L88-L124","documentation":"Thrown by the ConnectionParameters constructor (connection-parameters.js:105-108) when the sslnegotiation setting is set to a value other than 'postgres' or 'direct' (or undefined). sslnegotiation controls how the client initiates TLS: 'postgres' (default) uses the traditional SSLRequest packet, 'direct' begins the TLS handshake immediately. An unrecognized value indicates a typo or a setting from a different client library. The value can come from config.sslnegotiation or the PGSSLNEGOTIATION environment variable.","triggerScenarios":"Passing { sslnegotiation: 'prefer' } or setting PGSSLNEGOTIATION=auto. Any value that is not undefined, 'postgres', or 'direct' triggers the throw at line 106.","commonSituations":"Confusing sslmode values (prefer/require/verify-full) with sslnegotiation values. Setting PGSSLNEGOTIATION to an invalid string in a deployment manifest. Copying a configuration from a different PostgreSQL driver that supports different negotiation modes.","solutions":["Set sslnegotiation to 'postgres' (default, SSLRequest handshake) or 'direct' (immediate TLS).","If you do not need direct TLS negotiation, remove the sslnegotiation setting entirely to use the default.","Check the PGSSLNEGOTIATION environment variable in your deployment environment and correct or unset it."],"exampleFix":"// before\nconst client = new Client({ ssl: true, sslnegotiation: 'prefer' });\n\n// after\nconst client = new Client({ ssl: true, sslnegotiation: 'direct' });\n// or omit it for the default\nconst client = new Client({ ssl: true });","handlingStrategy":"validation","validationCode":"const VALID_SSL_NEGOTIATION = ['postgres', 'direct', undefined];\n\nfunction validateSslNegotiation(config) {\n  const val = config.sslnegotiation ?? process.env.PGSSLNEGOTIATION;\n  if (!VALID_SSL_NEGOTIATION.includes(val)) {\n    throw new Error(\n      `sslnegotiation '${val}' is invalid. Use 'postgres' or 'direct', or omit it.`\n    );\n  }\n}","typeGuard":"function isSslNegotiation(v) {\n  return v === undefined || v === 'postgres' || v === 'direct';\n}","tryCatchPattern":null,"preventionTips":["Do not confuse sslmode values (prefer/require/verify-full) with sslnegotiation values (postgres/direct).","Check the PGSSLNEGOTIATION environment variable in your deployment before connecting.","If you do not need direct TLS, omit sslnegotiation entirely to use the safe default."],"tags":["ssl","config","validation"],"analyzedSha":"c5e8c9a57bff6d9160ec5dbd5c4f4c1e4c460711","analyzedAt":"2026-08-03T18:47:28.334Z","schemaVersion":2}