`sslrootcert=system` is broken, requires installing `ca-certificates` package
Nobody has claimed this yet.
Assessment
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Newbie friendliness
- 45/100
- Issue type
- Bug
- Clarity
- Mostly clear
- Activity status
- Stale
- Tech stack
- docker, postgresql, shell
- Domain
- databases, devops, infrastructure
Research direction
Start by inspecting the Docker image definitions for PostgreSQL 16.x and reproduce the reported psql connection against a free-tier Neon database. Update the relevant image definitions so ca-certificates is installed, then verify that sslrootcert=system succeeds for the affected images.
Written by the indexing model from the issue text.
Description
Since Postgres 16, the sslrootcert=system connection parameter turns on sslmode=verify-full and instructs psql to use the system CA cert store. This is a lot more secure than sslmode=require and works very nicely for people with Postgres providers who use public CAs to secure their databases.
Unfortunately, sslrootcert=system currently doesn't work on the psql binaries shipped in these Docker images:
# psql 'postgresql://user:[email protected]/neondb?sslrootcert=system'
psql: error: connection to server at "ep-broad-dew-xyz.us-east-2.aws.neon.tech" (3.x.x.x), port 5432 failed: SSL error: certificate verify failed
Fortunately, the fix is simple: apt-get update && apt-get install ca-certificates does the trick. It's also simple to test the fix using a free-tier Neon DB.
Would you be able to update all images from 16.x up to come with the ca-certificates package installed, to make this work?
I'm maintaining a list of psql distributions that do and don't work here: https://gist.github.com/jawj/57bc9d1f350ffd5250942cf24957b3a7
- Dominant language
- Shell
- Stars
- 2.5k
- Forks
- 1.2k
- PR merge metrics
- No merged PRs in 30d
Getting set up
This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from docker-library/postgres
-
Difficulty 4/5 3-5 days Newbie friendliness 48/100
docker-library/postgres#1420 ·
-
Difficulty 4/5 3-5 days Newbie friendliness 48/100
docker-library/postgres#1419 · 2 comments ·
-
Difficulty 4/5 3-5 days Newbie friendliness 35/100
docker-library/postgres#1389 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 35/100
docker-library/postgres#1356 · 5 comments · 7 reactions ·
-
Difficulty 4/5 3-5 days Newbie friendliness 25/100
docker-library/postgres#1355 · 10 comments · 11 reactions ·
All issues in docker-library/postgres
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
adobe-fonts/source-serif#152 ·
-
area:ansible source:reader type:content-error
Difficulty 1/5 Under an hour Newbie friendliness 86/100
stephrobert/blog-roadmap#42 ·
-
Difficulty 1/5 Under an hour Newbie friendliness 90/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
nolabs-ai/nono-packs#44 ·
Maintainers usually reply within 1 day