Cannot connect using certificate authentication and minimum protocol version TLSv1.3

See original GitHub issue

Steps to reproduce

Enable certificate authentication: pg_hba.conf -> hostssl all all ::/0 cert Set minimum protocol version: postgresql.conf -> ssl_min_protocol_version = 'TLSv1.3' Try to open a connection using:

  • SSL Mode = VerifyFull;
  • Client Certificate
  • Client Certificate Key
  • Root Certificate
  • Check Certificate Revocation = true;

The issue

Opening a connection fails with the following exception:

Npgsql.NpgsqlException (0x80004005): Exception while performing SSL handshake
 ---> System.Security.Authentication.AuthenticationException: Authentication failed because the remote party sent a TLS alert: 'ProtocolVersion'.
 ---> System.ComponentModel.Win32Exception (0x80090326): The message received was unexpected or badly formatted.
   --- End of inner exception stack trace ---
   at System.Net.Security.SslStream.ForceAuthenticationAsync[TIOAdapter](TIOAdapter adapter, Boolean receiveFirst, Byte[] reAuthenticationData, Boolean isApm)
   at Npgsql.Internal.NpgsqlConnector.RawOpen(SslMode sslMode, NpgsqlTimeout timeout, Boolean async, CancellationToken cancellationToken)
   at Npgsql.Internal.NpgsqlConnector.RawOpen(SslMode sslMode, NpgsqlTimeout timeout, Boolean async, CancellationToken cancellationToken)
   at Npgsql.Internal.NpgsqlConnector.<Open>g__OpenCore|195_1(NpgsqlConnector conn, SslMode sslMode, NpgsqlTimeout timeout, Boolean async, CancellationToken cancellationToken)
   at Npgsql.Internal.NpgsqlConnector.Open(NpgsqlTimeout timeout, Boolean async, CancellationToken cancellationToken)
   at Npgsql.ConnectorPool.OpenNewConnector(NpgsqlConnection conn, NpgsqlTimeout timeout, Boolean async, CancellationToken cancellationToken)
   at Npgsql.ConnectorPool.<Get>g__RentAsync|29_0(NpgsqlConnection conn, NpgsqlTimeout timeout, Boolean async, CancellationToken cancellationToken)
   at Npgsql.NpgsqlConnection.<Open>g__OpenAsync|45_0(Boolean async, CancellationToken cancellationToken)

PostgreSQL logs:

[unknown]@[unknown] LOG:  could not accept SSL connection: unsupported protocol
[unknown]@[unknown] HINT:  This may indicate that the client does not support any SSL protocol version between TLSv1.3 and TLSv1.3.

I can connect to the same PostgreSQL instance from the same client machine with the connection parameters from JetBrains Rider, so it seems to me that the issue is with Npgsql. I also could not find anything related to TLS versions in the documenation. Is some additional configuration needed to use TLSv1.3?

Further technical details

Npgsql version: 6.0.0 PostgreSQL version: postgres (PostgreSQL) 14.1 (Ubuntu 14.1-1.pgdg20.04+1) Operating system: Windows 10 19043.1288

Issue Analytics

  • State:closed
  • Created 2 years ago
  • Comments:6 (3 by maintainers)

github_iconTop GitHub Comments

github_iconTop Results From Across the Web

Solving the TLS 1.0 Problem - Security documentation
This document presents guidance on rapidly identifying and removing Transport Layer Security (TLS) protocol version 1.0 dependencies in ...
Read more >
TLSv1.3 SSL Decryption Support - PAN-OS
You can configure an SSL Decryption profile that sets TLSv1.3 as the minimum allowed protocol version to achieve the tightest security.
Read more >
Enabling TLS 1.3
To enable the TLS 1.3 protocol on the server, use the jdk.tls.server.protocols system property. Examples of how to enable the TLS 1.3 protocol...
Read more >
TLS1.3 - OpenSSLWiki
DSA certificates are no longer allowed in TLSv1.3. From OpenSSL 1.1.0 and above ciphersuites for TLSv1.2 and below based on DSA are no...
Read more >
How to Fix the SSL/TLS Handshake Failed Error? - AboutSSL
Here's the Server-Side Errors and Its Solution · 1. Protocol Mismatch · 2. Cipher Suite Mismatch · 3. Incorrect SSL/TLS Certificate · 4....
Read more >

github_iconTop Related Medium Post

No results found

github_iconTop Related StackOverflow Question

No results found

github_iconTroubleshoot Live Code

Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start Free

github_iconTop Related Reddit Thread

No results found

github_iconTop Related Hackernoon Post

No results found

github_iconTop Related Tweet

No results found

github_iconTop Related Dev.to Post

No results found

github_iconTop Related Hashnode Post

No results found