{"id":"c658f85f32ffdeec","repo":"jackc/pgx","slug":"channel-binding-required-but-failed-to-get-server","errorCode":null,"errorMessage":"channel binding required but failed to get server certificate hash: %w","messagePattern":"channel binding required but failed to get server certificate hash: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pgconn/auth_scram.go","lineNumber":59,"sourceCode":"\n// Perform SCRAM authentication.\nfunc (c *PgConn) scramAuth(serverAuthMechanisms []string) error {\n\tsc, err := newScramClient(serverAuthMechanisms, c.config.Password)\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tserverHasPlus := slices.Contains(sc.serverAuthMechanisms, scramSHA256PlusName)\n\tif c.config.ChannelBinding == \"require\" && !serverHasPlus {\n\t\treturn errors.New(\"channel binding required but server does not support SCRAM-SHA-256-PLUS\")\n\t}\n\n\t// If we have a TLS connection and channel binding is not disabled, attempt to\n\t// extract the server certificate hash for tls-server-end-point channel binding.\n\tif tlsConn, ok := c.conn.(*tls.Conn); ok && c.config.ChannelBinding != \"disable\" {\n\t\tcertHash, err := getTLSCertificateHash(tlsConn)\n\t\tif err != nil && c.config.ChannelBinding == \"require\" {\n\t\t\treturn fmt.Errorf(\"channel binding required but failed to get server certificate hash: %w\", err)\n\t\t}\n\n\t\t// Upgrade to SCRAM-SHA-256-PLUS if we have binding data and the server supports it.\n\t\tif certHash != nil && serverHasPlus {\n\t\t\tsc.authMechanism = scramSHA256PlusName\n\t\t}\n\n\t\tsc.channelBindingData = certHash\n\t\tsc.hasTLS = true\n\t}\n\n\tif c.config.ChannelBinding == \"require\" && sc.channelBindingData == nil {\n\t\treturn errors.New(\"channel binding required but channel binding data is not available\")\n\t}\n\n\t// Send client-first-message in a SASLInitialResponse\n\tsaslInitialResponse := &pgproto3.SASLInitialResponse{\n\t\tAuthMechanism: sc.authMechanism,","sourceCodeStart":41,"sourceCodeEnd":77,"githubUrl":"https://github.com/jackc/pgx/blob/ec1a0befd22592cffffdeeb0a50311b506372f4c/pgconn/auth_scram.go#L41-L77","documentation":"Error \"channel binding required but failed to get server certificate hash: %w\" thrown in jackc/pgx.","triggerScenarios":"Thrown at pgconn/auth_scram.go:59 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":[],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"analyzedSha":"ec1a0befd22592cffffdeeb0a50311b506372f4c","analyzedAt":"2026-08-04T22:52:11.263Z","schemaVersion":2}