Not connecting to database in version 7.18.1 with ssl=true: unsupported frontend protocol

Hi there,

After the new release, version 7.18.1, our production server failed to connect to the database throwing the following error:

error: unsupported frontend protocol 1234.5679: server supports 2.0 to 3.0 at Connection.parseE (/var/app/current/node_modules/pg/lib/connection.js:624:13) at Connection.parseMessage (/var/app/current/node_modules/pg/lib/connection.js:423:19) at TLSSocket.<anonymous> (/var/app/current/node_modules/pg/lib/connection.js:139:22) at TLSSocket.emit (events.js:198:13) at TLSSocket.EventEmitter.emit (domain.js:448:20) at addChunk (_stream_readable.js:288:12) at readableAddChunk (_stream_readable.js:269:11) at TLSSocket.Readable.push (_stream_readable.js:224:10) at TLSWrap.onStreamRead [as onread] (internal/stream_base_commons.js:94:17)

DeprecationWarning: Implicit disabling of certificate verification is deprecated and will be removed in pg 8. Specify rejectUnauthorized: true to require a valid CA or rejectUnauthorized: false to explicitly opt out of MITM protection.

I have a nodejs app with express that connects to a database in RDS on AWS. The connection to the database is done with the following url:

postgres://user:[e-mail]:5432/database?ssl=true

If I remove the “ssl=true” part it works, but that would mean there connection is not secure, right?

If I go back to use the 7.17.x version my problem is fixed.

Should I add more paramenters to the database url? Or I am missing something else?

Thank you in advance!

[charmander]

See https://www.postgresql.org/docs/current/libpq-ssl.html#LIBPQ-SSL-PROTECTION. If you want your certificate checked (sslmode=verify-full), add this to your pg configuration:

ssl: {
    rejectUnauthorized: true,
},

If you don’t (sslmode=require):

ssl: {
    rejectUnauthorized: false,
},

The full list of options is at https://nodejs.org/api/tls.html#tls_tls_connect_options_callback if you need to specify your own CA certificate or implement the equivalent of sslmode=verify-ca.

[rodrigomf24]

for all of those that fall in here if you are using knex just specify the connection in the following way:

{
  connection: {
     connectionString: <psql connection string>,
     ssl: { rejectUnauthorized: false },
  }
}