search

lib / pq

Pure Go Postgres driver for database/sql
https://pkg.go.dev/github.com/lib/pq
MIT License
9.04k stars 909 forks source link

x509: certificate is valid for dbname.hashcode.eu-west-1.rds.amazonaws.com, not dbname.company.internal #1094

Closed AdamGlazerMW closed 1 year ago

AdamGlazerMW commented 1 year ago

I have a setup where a Postgres DB hosted in AWS has a shorter CNAME configured in Route 53.

I've been using the shorter canonical name to connect to the DB with the common rds-ca-2019-eu-west-1.pem up to lib/pq v1.10.5, but after upgrading to v1.10.7 I'm receiving the error message x509: certificate is valid for dbname.hashcode.eu-west-1.rds.amazonaws.com, not dbname.company.internal when trying to connect to it.

If I change the host in the connection params to dbname.hashcode.eu-west-1.rds.amazonaws.com then the error ceases, but I'm unable to make it work with the shorter host

Is this an AWS misconfiguration issue somewhere, or is this caused by the changes between 1.10.5 and 1.10.7 making the connection process stricter?

AdamGlazerMW commented 1 year ago

Figured it out.

The solution is to add sslsni=0 to the connection parameters, so that the servername isn't explicitly checked