SSL error: certificate verify failed when connection to Azure PostgreSQL

Question

Hi, I have faced SSL error: certificate verify failed error today, while everything worked correctly yesterday. I specify sslmode="require" and sslrootcert="/path/to/DigiCertGlobalRootG2.crt.pem".

I also tried BaltimoreCyberTrustRoot.crt.pem as specified here: https://learn.microsoft.com/en-us/answers/questions/114381/failed-to-connect-to-azure-postgresql-with-ssl-ena - I am getting the same error.

What could happen and how to fix it?

Answer 1

Ok, I have found that you need to use this one:

https://www.microsoft.com/pkiops/certs/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crt

And don't forget to do: openssl x509 -inform DER -in certificate.crt -out certificate.pem -outform PEM (certificate.crt is just the renamed file that you will download from URL above)

Source: https://learn.microsoft.com/en-us/azure/postgresql/flexible-server/concepts-networking-ssl-tls#downloading-root-ca-certificates-and-updating-application-clients-in-certificate-pinning-scenarios

Answer 2

Hi @ Vitalii,

I'm glad that you were able to resolve your issue and thank you for posting your solution so that others experiencing the same thing can easily reference this! Since the Microsoft Q&A community has a policy that "The question author cannot accept their own answer. They can only accept answers by others ", I'll repost your solution in case you'd like to accept the answer.

Issue:

Hi, I have faced SSL error: certificate verify failed error today, while everything worked correctly yesterday. I specify sslmode="require" and sslrootcert="/path/to/DigiCertGlobalRootG2.crt.pem".

I also tried BaltimoreCyberTrustRoot.crt.pem as specified here: https://learn.microsoft.com/en-us/answers/questions/114381/failed-to-connect-to-azure-postgresql-with-ssl-ena - I am getting the same error.

What could happen and how to fix it?

Solution:

Ok, I have found that you need to use this one:

https://www.microsoft.com/pkiops/certs/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crt

And don't forget to do: openssl x509 -inform DER -in certificate.crt -out certificate.pem -outform PEM (certificate.crt is just the renamed file that you will download from URL above)

Source: https://learn.microsoft.com/en-us/azure/postgresql/flexible-server/concepts-networking-ssl-tls#downloading-root-ca-certificates-and-updating-application-clients-in-certificate-pinning-scenarios

If I missed anything please let me know and I'd be happy to add it to my answer, or feel free to comment below with any additional information.

Hope this helps. Do let us know if you have any further queries.

---

If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.