The PostgreSQL 42.6.0 driver does not support ECDSA (Elliptic Curve Digital Signature Algorithm)

[SUNsung]

Describe the problem

I encountered an issue where Go (and CockroachDB) works fine with any kind of certificates, but when trying to connect a 3rd party application (JetBrains), I ran into cryptography problems.

To Reproduce

I followed the instructions from the CockroachDB documentation, but it didn't work as expected. Six hours later, I discovered it was a PostgreSQL driver issue (version 42.2 to 42.6, I haven’t tested earlier versions). Through experimentation, I found that the driver only works with RSA cryptography.

Expected behavior

It would be helpful if this was mentioned in the documentation.

Environment:

• CockroachDB version v23.1.28
• Server OS: Docker
• Client app: intellij-idea

---

Also there are questions about cryptography that I haven't found in the documentation:

1. Is it possible to update the certificate without restarting the node (especially for the CA)?
2. How can I disable TLS for the webserver (port 8080) without disabling TLS for everything else?
3. How can I run the node without a webserver, just as part of a cluster?

Jira issue: CRDB-43267

[blathers-crl[bot]]

Hi @SUNsung, please add branch-* labels to identify which branch(es) this C-bug affects.

_{:owl: Hoot! I am a Blathers, a bot for CockroachDB. My owner is dev-inf.}

[blathers-crl[bot]]

Hello, I am Blathers. I am here to help you get the issue triaged.

Hoot - a bug! Though bugs are the bane of my existence, rest assured the wretched thing will get the best of care here.

I was unable to automatically find someone to ping.

If we have not gotten back to your issue within a few business days, you can try the following:

• Join our community slack channel and ask on #cockroachdb.
• Try find someone from here if you know they worked closely on the area and CC them.

_{:owl: Hoot! I am a Blathers, a bot for CockroachDB. My owner is dev-inf.}

[souravcrl]

For 1, It is possible but only for the case where we are running the nodes directly and not using k8s using SIGHUP https://www.cockroachlabs.com/docs/v23.2/rotate-certificates#rotate-the-ca-certificate