I noticed while working on general fixes for the certificate handling that if we have a connection being attempted with sslmode=prefer (which happens to be our default), we will loose error messages.
Basically, if we fail the SSL connection, we will throw away the error message and try a cleartext connection. Now, if the server is configured to require SSL (using hostssl), you will get an error message that says "there is no pg_hba, etc, SSL off". Which is totally misleading, because I *tried* to connect with SSL, but failed. If I set sslmode=require, the error message is properly reported. AFAIK we don't actually have a way to pass back an intermediate result here, but we really need to report this error *somehow*. It may even be to the point that if we connect and get a client side SSL error, we should just report it and abort, and only retry if the error is actually a server error saying there is no pg_hba for SSL here? (or I'm missing something obvious :-P) //Magnus -- Sent via pgsql-hackers mailing list (pgsql-hackers@postgresql.org) To make changes to your subscription: http://www.postgresql.org/mailpref/pgsql-hackers
