Exception while performing SSL handshake

Question

We are encountering an intermittent issue: "Exception while performing SSL handshake" when connecting to Azure Cosmos DB for PostgreSQL 16 with Citus 12.

• Minimum TLS Version: 1.2
• Framework: .NET Core 3.1
• Library: Npgsql 8.0 using ADO.NET

Exception:
Message: Exception while performing SSL handshake
Stacktrace:
  at Npgsql.Internal.NpgsqlConnector.<RawOpen>d__217.MoveNext()    at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()    at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)    at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)    at Npgsql.Internal.NpgsqlConnector.<<Open>g__OpenCore|213_1>d.MoveNext()    at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()    at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)    at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)    at Npgsql.Internal.NpgsqlConnector.<Open>d__213.MoveNext()    at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()    at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)    at Npgsql.PoolingDataSource.<OpenNewConnector>d__31.MoveNext()    at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()    at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)    at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)    at Npgsql.PoolingDataSource.<<Get>g__RentAsync|28_0>d.MoveNext()    at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()    at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)    at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)    at Npgsql.NpgsqlConnection.<<Open>g__OpenAsync|45_0>d.MoveNext()    at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()    at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)    at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)    at Npgsql.NpgsqlConnection.Open()

InnerException:
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()    at System.Net.Security.SslStream.StartSendAuthResetSignal(ProtocolToken message, AsyncProtocolRequest asyncRequest, ExceptionDispatchInfo exception)    at System.Net.Security.SslStream.CheckCompletionBeforeNextReceive(ProtocolToken message, AsyncProtocolRequest asyncRequest)    at System.Net.Security.SslStream.StartSendBlob(Byte[] incoming, Int32 count, AsyncProtocolRequest asyncRequest)    at System.Net.Security.SslStream.ProcessReceivedBlob(Byte[] buffer, Int32 count, AsyncProtocolRequest asyncRequest)    at System.Net.Security.SslStream.StartReceiveBlob(Byte[] buffer, AsyncProtocolRequest asyncRequest)    at System.Net.Security.SslStream.CheckCompletionBeforeNextReceive(ProtocolToken message, AsyncProtocolRequest asyncRequest)    at System.Net.Security.SslStream.StartSendBlob(Byte[] incoming, Int32 count, AsyncProtocolRequest asyncRequest)    at System.Net.Security.SslStream.ForceAuthentication(Boolean receiveFirst, Byte[] buffer, AsyncProtocolRequest asyncRequest)    at System.Net.Security.SslStream.ProcessAuthentication(LazyAsyncResult lazyResult, CancellationToken cancellationToken)    at System.Net.Security.SslStream.AuthenticateAsClient(SslClientAuthenticationOptions sslClientAuthenticationOptions)    at System.Net.Security.SslStream.AuthenticateAsClient(String targetHost, X509CertificateCollection clientCertificates, SslProtocols enabledSslProtocols, Boolean checkCertificateRevocation)    at Npgsql.Internal.NpgsqlConnector.<RawOpen>d__217.MoveNext()

Message: The message received was unexpected or badly formatted.

Answer 1

Hi Deependra Singh •,

Thanks for your patience.

Could you please check SSL configuration at Database level.

Also, try to use upgrade version and retry.

Check the server-side TLS version settings and confirm that both client and server support TLS 1.2. You might also want to explicitly set the SslProtocols property in your .NET code to enforce TLS 1.2.

Let us know if this helped.

Thanks