libpqxx: Cannot connect to Database using ssl

I am trying to connect to my rds database instance from my fargate service using libpqxx library in c++ but i am unable to do so. the log on the rds side is:

2023-04-20 11:40:40 UTC:10.10.2.103(46582):[unknown]@[unknown]:[1939]:LOG: could not accept SSL connection: EOF detected

the code is:

  try {
    const auto dbConnString1 =
        "host=cdk-rds-postgresdb7ff341c6... "
        "dbname=SB_Database "
        "user=database_user "
        "password=passss "
        "port=5432 "
        "sslrootcert=/etc/ssl/certs "
        "sslmode=verify-full";
    pqxx::connection conn(dbConnString1);
    std::cout << "Connected to the PostgreSQL database." << std::endl;
  } catch (const std::exception& e) {
    std::cerr << "Error: " << e.what() << std::endl;
    return 1;
  }

log on the c++:

Error: connection to server at "cdk-rds-postgresdb7ff341c6..." (10.10.4.24), port 5432 failed: could not create SSL context: malloc failure

I tried to connect with a python app using psycopg2-binary and I Successfully connect to the db with the same configuration and without specifying the sslrootcert and sslmode fields.

the docker image I am using for my c++ container is: debian:bookworm-slim with ca-certificates installed while for the python app, I am using python:3.9-slim-buster

Any help would be much appreciated!

About this issue

  • Original URL
  • State: closed
  • Created a year ago
  • Comments: 23 (14 by maintainers)

Most upvoted comments

sslmode=required is wrong sslmode=require is correct. but sslmode=verify-ca is better.

Quote: https://www.postgresql.org/docs/15/libpq-ssl.html

Note For backwards compatibility with earlier versions of PostgreSQL, if a root CA file exists, the behavior of sslmode=require will be the same as that of verify-ca, meaning the server certificate is validated against the CA. Relying on this behavior is discouraged, and applications that need certificate validation should always use verify-ca or verify-full.

And it is libpq’s role to establish SSL connections using OpenSSL. If there is a problem, it is the build of libpq.