risingwavelabs/risingwave · error · PsqlError

Unable to setup an SSL connection

Error message

Unable to setup an SSL connection

What it means

Pgwire failed to establish a TLS session using the openssl crate when the client requested SSL. This wraps an `openssl::ssl::Error` (handshake failure, certificate problem, protocol mismatch) under a fixed top-level message.

Source

Thrown at src/utils/pgwire/src/error.rs:81

    ),

    #[error(transparent)]
    IoError(#[from] IoError),

    /// Uncategorized error for describe, bind.
    #[error(transparent)]
    Uncategorized(
        #[from]
        #[backtrace]
        BoxedError,
    ),

    #[error("Panicked when handling the request: {0}
This is a bug. We would appreciate a bug report at:
  https://github.com/risingwavelabs/risingwave/issues/new?labels=type%2Fbug&template=bug_report.yml")]
    Panic(String),

    #[error("Unable to setup an SSL connection")]
    SslError(#[from] openssl::ssl::Error),

    #[error("terminating connection due to idle-in-transaction timeout")]
    IdleInTxnTimeout,

    #[error("Server throttled: {0}")]
    ServerThrottle(String),
}

#[derive(Debug)]
pub struct ProtocolViolationError(String);

impl fmt::Display for ProtocolViolationError {
    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
        self.0.fmt(f)
    }
}

View on GitHub (pinned to 6469eb736d)

Solutions

1. Check server TLS certificate and private key configuration (paths, validity, matching key pair).
2. Verify client and server support a common TLS version and cipher suite.
3. Inspect the inner openssl::ssl::Error (source) for the precise handshake stage failure.
4. As a stopgap, connect without SSL (`sslmode=disable`) while fixing TLS config.

Example fix

// before: expired cert in config
ssl_cert = "server_expired.crt"
// after: renewed cert
ssl_cert = "server_renewed.crt"

openssl x509 -in server.crt -noout -dates   # check validity
openssl rsa -in server.key -check -noout    # check key
openssl s_client -connect host:4566 -starttls postgres 2>/dev/null | head -5

match err {
    PsqlError::SslError(e) => eprintln!("TLS handshake failed: {}", e),
    other => return Err(other),
}

When it happens

Trigger: Client sends an SSLRequest and the server's TLS handshake via openssl fails — e.g. mismatched TLS versions/ciphers, invalid server certificate/key, or mid-handshake IO failure.

Common situations: Misconfigured TLS cert/key paths on the server; clients requiring TLS versions the server's openssl build doesn't support; expired or self-signed certificates rejected during handshake.

Understand the failure class

Background: 'Something went wrong' / 'Request failed (500)' / 'HTTP error! status: 404' — what failed HTTP requests actually mean and how to find the real cause — this error's family across 28 libraries.

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• bad ssl root cert error: {}
• No private key found
• could not load platform certs
• read ca file error: {0}
• parse ca file error: {0}

AI-assisted analysis of risingwavelabs/risingwave@6469eb736d (2026-09-11). Data as JSON: /api/errors/41fb636106536624. Report an issue: GitHub.