How to fix could not accept SSL connection: wrong version number in PostgreSQL

PostgreSQLINTERMEDIATEHIGHUpdated Dec 28, 2025· 188 views

This error occurs when the PostgreSQL server and client have incompatible TLS/SSL protocol versions. The server rejects the connection because the client's TLS version doesn't match the server's minimum or maximum allowed versions. Update your client software or adjust server SSL configuration to fix this.

Quick fix

Fixes could not accept SSL connection: wrong version number

# Connect locally as superuser
sudo -u postgres psql
  1. Verify PostgreSQL server TLS configuration
  2. Check client OpenSSL version and TLS support
  3. Update client software to newer version
  4. Lower server's minimum TLS version (if safe)
postgresql — error
# Connect locally as superuser
sudo -u postgres psql
could not accept SSL connection: wrong version number

What this error means

PostgreSQL uses TLS (Transport Layer Security) to encrypt connections. When a client attempts to connect, the server and client must negotiate a compatible TLS protocol version. If they don't have overlapping supported versions, the connection fails with this 'wrong version number' error. This commonly happens when clients using older TLS 1.0/1.1 try to connect to PostgreSQL 13+, which defaults to requiring TLS 1.2 or higher for security compliance.

Typical symptoms

  • Connection attempts fail immediately with SSL handshake errors
  • psql, pgAdmin, DBeaver, or application clients cannot connect
  • Error appears in PostgreSQL server logs: 'LOG: could not accept SSL connection: wrong version number'
  • Connections work fine over local Unix sockets (non-SSL)
  • Error appears only for remote TCP/IP connections with sslmode=require
  • Upgrading PostgreSQL to version 13+ breaks existing client connections

Common causes

  1. Client supports TLS 1.0 or 1.1, but server requires TLS 1.2+ (PostgreSQL 13+ defaults to TLS 1.2)
  2. Client library compiled against old OpenSSL version that doesn't support server's TLS version
  3. Server explicitly configured with ssl_min_protocol_version set too high for client capabilities
  4. Driver or ORM (Prisma, node-postgres, etc.) doesn't support the server's TLS version
  5. Proxy, load balancer, or firewall strips or modifies SSL/TLS handshake frames
  6. Corporate security settings force older TLS versions incompatible with PostgreSQL server

How to fix "could not accept SSL connection: wrong version number"

1Verify PostgreSQL server TLS configuration

Check what TLS versions your PostgreSQL server is configured to accept:

bash
# Connect locally as superuser
sudo -u postgres psql

Then run:

sql
SHOW ssl_min_protocol_version;
SHOW ssl_max_protocol_version;

Common output:
- TLSv1.2 (default in PostgreSQL 13+)
- TLSv1.3 (if explicitly configured)

Note these values for comparison with your client.

2Check client OpenSSL version and TLS support

Verify what TLS versions your client supports:

bash
# Check OpenSSL version
openssl version

# List supported TLS versions
openssl s_client -h 2>&1 | grep -i "\-tls"

# Or check OpenSSL capabilities
openssl ciphers -v | grep TLS

Required OpenSSL versions for TLS support:
- TLS 1.2: OpenSSL 1.0.1+ (2012)
- TLS 1.3: OpenSSL 1.1.1+ (2018)

If you have an older OpenSSL version, your client cannot connect to PostgreSQL 13+.

3Update client software to newer version

The easiest fix is to upgrade your PostgreSQL client or driver to a recent version that supports TLS 1.2+:

bash
# Update psql client (PostgreSQL)
sudo apt-get update && sudo apt-get install --only-upgrade postgresql-client

# Or for Homebrew on macOS
brew upgrade postgresql

# Update Node.js drivers
npm update pg node-postgres

# Update Python drivers
pip install --upgrade psycopg2 or psycopg[binary]

# Update Java JDBC driver
# Download latest version from https://jdbc.postgresql.org

Alternatively, update your application language/runtime:

bash
# Update Node.js
nvm install node

# Update Python
python3 --version  # Check current
pip install --upgrade python
4Lower server's minimum TLS version (if safe)

If you cannot update clients immediately, you can temporarily lower the server's minimum TLS requirement. Warning: TLS 1.0 and 1.1 are deprecated for security reasons.

Edit your PostgreSQL configuration file (usually /etc/postgresql/VERSION/main/postgresql.conf):

bash
sudo nano /etc/postgresql/VERSION/main/postgresql.conf

Find or add:

bash
ssl_min_protocol_version = 'TLSv1.0'  # or TLSv1.1 for slightly better security
ssl = on

Then reload PostgreSQL:

bash
sudo systemctl reload postgresql

Better approach: Set it to TLS 1.1 temporarily while upgrading clients:

bash
ssl_min_protocol_version = 'TLSv1.1'
5Explicitly specify TLS version on client (if supported)

Some clients allow you to force a specific TLS version. Examples:

psql command line:

bash
psql -h db.example.com -U user -d dbname -v sslmode=require

OpenSSL s_client (for testing):

bash
openssl s_client -connect db.example.com:5432 -tls1_2

Node.js (node-postgres):

javascript
const { Pool } = require('pg');
const pool = new Pool({
  host: 'db.example.com',
  port: 5432,
  user: 'user',
  password: 'password',
  database: 'dbname',
  ssl: {
    rejectUnauthorized: false,
    minVersion: 'TLSv1.2'  // Force TLS 1.2
  }
});

Python (psycopg2):

python
import psycopg2
import ssl

ssl_context = ssl.SSLContext(ssl.PROTOCOL_TLSv1_2)
conn = psycopg2.connect(
    host='db.example.com',
    user='user',
    password='password',
    sslmode='require',
    sslrootcert='/path/to/ca.crt'
)
6Test the connection with openssl s_client

Use OpenSSL to test if your client and server can negotiate a common TLS version:

bash
openssl s_client -connect db.example.com:5432 -starttls postgres

Look for output like:

bash
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : ECDHE-RSA-AES256-GCM-SHA384
    Session-ID: ...

If the connection fails, you'll see:

bash
no ciphers available
error:...

This confirms the TLS version mismatch. If successful, it proves a common TLS version exists.

7Check for proxy or firewall interference

If updating client and server TLS versions doesn't help, verify that proxies, load balancers, or firewalls aren't interfering:

bash
# Test direct connection (if possible)
telnet db.example.com 5432

# Test connection through proxy/jumphost
telnet proxy.internal:5432

# Verify firewall rules allow SSL traffic
sudo ufw status | grep 5432
# or
sudo iptables -L -n | grep 5432

Some firewalls or proxies split SSL frames or buffer handshake packets incorrectly. If this is the case:
- Whitelist the PostgreSQL port (5432) for direct traffic
- Use a tunnel or VPN instead of a proxy
- Contact your network administrator to allow unmodified SSL passthrough

8Verify certificate validity (if using client certs)

If your connection uses client-side certificates, verify they're valid and match the server's requirements:

bash
# Check certificate expiration
openssl x509 -in /path/to/client.crt -text -noout | grep -A2 'Validity'

# Check certificate format
file /path/to/client.crt

# Verify certificate chain
openssl verify -CAfile /path/to/ca.crt /path/to/client.crt

Expired or mismatched certificates can cause SSL handshake failures. Regenerate certificates if needed and ensure the server's ssl_cert_file and ssl_key_file point to valid files.

Advanced notes

TLS Negotiation: When a client connects, both sides send a list of supported TLS versions and ciphers. If there's no overlap, the connection fails. PostgreSQL 13+ removed TLS 1.0 and 1.1 support entirely, making this a hard requirement. OpenSSL Upgrade Strategy: If your system has an ancient OpenSSL (< 1.0.1), consider upgrading the entire operating system or using a container (Docker) with a modern base image. Connection Poolers: Tools like PgBouncer or pgpool may be outdated and not support modern TLS versions. Check their version and upgrade if necessary. Docker Considerations: If PostgreSQL runs in Docker, ensure the base image (Alpine, Ubuntu, etc.) has a current OpenSSL version. RDS/Managed Services: For AWS RDS, Azure Database, or GCP Cloud SQL, you typically cannot adjust ssl_min_protocol_version. Update clients instead. Corporate Networks: Large organizations may have TLS interception proxies. Work with your security team to verify the proxy supports TLS 1.2+ and allow it through firewall rules. Testing Tool: Use openssl s_client -starttls postgres -connect host:5432 -tlsv1_2 to simulate connections and debug TLS issues.

Frequently asked questions

What does "could not accept SSL connection: wrong version number" mean?
PostgreSQL uses TLS (Transport Layer Security) to encrypt connections. When a client attempts to connect, the server and client must negotiate a compatible TLS protocol version. If they don't have overlapping supported versions, the connection fails with this 'wrong version number' error.
How do I fix "could not accept SSL connection: wrong version number"?
This error occurs when the PostgreSQL server and client have incompatible TLS/SSL protocol versions. The server rejects the connection because the client's TLS version doesn't match the server's minimum or maximum allowed versions. Update your client software or adjust server SSL configuration to fix this.
What causes "could not accept SSL connection: wrong version number"?
Client supports TLS 1.0 or 1.1, but server requires TLS 1.2+ (PostgreSQL 13+ defaults to TLS 1.2) Client library compiled against old OpenSSL version that doesn't support server's TLS version Server explicitly configured with ssl_min_protocol_version set too high for client capabilities
Is the "could not accept SSL connection: wrong version number" error serious?
Yes. This is a high-severity error that usually blocks work until it is fixed, but the steps above resolve it.

Official resources & further reading