How to fix could not accept SSL connection: wrong version number in PostgreSQL

PostgreSQLINTERMEDIATEHIGH

This error occurs when the PostgreSQL server and client have incompatible TLS/SSL protocol versions. The server rejects the connection because the client's TLS version doesn't match the server's minimum or maximum allowed versions. Update your client software or adjust server SSL configuration to fix this.

What this error means

PostgreSQL uses TLS (Transport Layer Security) to encrypt connections. When a client attempts to connect, the server and client must negotiate a compatible TLS protocol version. If they don't have overlapping supported versions, the connection fails with this 'wrong version number' error. This commonly happens when clients using older TLS 1.0/1.1 try to connect to PostgreSQL 13+, which defaults to requiring TLS 1.2 or higher for security compliance.

How to fix "could not accept SSL connection: wrong version number"

1Verify PostgreSQL server TLS configuration

Check what TLS versions your PostgreSQL server is configured to accept:

bash

# Connect locally as superuser
sudo -u postgres psql

Then run:

sql

SHOW ssl_min_protocol_version;
SHOW ssl_max_protocol_version;

Common output:
- TLSv1.2 (default in PostgreSQL 13+)
- TLSv1.3 (if explicitly configured)

Note these values for comparison with your client.

2Check client OpenSSL version and TLS support

Verify what TLS versions your client supports:

bash

# Check OpenSSL version
openssl version

# List supported TLS versions
openssl s_client -h 2>&1 | grep -i "\-tls"

# Or check OpenSSL capabilities
openssl ciphers -v | grep TLS

Required OpenSSL versions for TLS support:
- TLS 1.2: OpenSSL 1.0.1+ (2012)
- TLS 1.3: OpenSSL 1.1.1+ (2018)

If you have an older OpenSSL version, your client cannot connect to PostgreSQL 13+.

3Update client software to newer version

The easiest fix is to upgrade your PostgreSQL client or driver to a recent version that supports TLS 1.2+:

bash

# Update psql client (PostgreSQL)
sudo apt-get update && sudo apt-get install --only-upgrade postgresql-client

# Or for Homebrew on macOS
brew upgrade postgresql

# Update Node.js drivers
npm update pg node-postgres

# Update Python drivers
pip install --upgrade psycopg2 or psycopg[binary]

# Update Java JDBC driver
# Download latest version from https://jdbc.postgresql.org

Alternatively, update your application language/runtime:

bash

# Update Node.js
nvm install node

# Update Python
python3 --version  # Check current
pip install --upgrade python

4Lower server's minimum TLS version (if safe)

If you cannot update clients immediately, you can temporarily lower the server's minimum TLS requirement. Warning: TLS 1.0 and 1.1 are deprecated for security reasons.

Edit your PostgreSQL configuration file (usually /etc/postgresql/VERSION/main/postgresql.conf):

bash

sudo nano /etc/postgresql/VERSION/main/postgresql.conf

Find or add:

bash

ssl_min_protocol_version = 'TLSv1.0'  # or TLSv1.1 for slightly better security
ssl = on

Then reload PostgreSQL:

bash

sudo systemctl reload postgresql

Better approach: Set it to TLS 1.1 temporarily while upgrading clients:

bash

ssl_min_protocol_version = 'TLSv1.1'

5Explicitly specify TLS version on client (if supported)

Some clients allow you to force a specific TLS version. Examples:

psql command line:

bash

psql -h db.example.com -U user -d dbname -v sslmode=require

OpenSSL s_client (for testing):

bash

openssl s_client -connect db.example.com:5432 -tls1_2

Node.js (node-postgres):

javascript

const { Pool } = require('pg');
const pool = new Pool({
  host: 'db.example.com',
  port: 5432,
  user: 'user',
  password: 'password',
  database: 'dbname',
  ssl: {
    rejectUnauthorized: false,
    minVersion: 'TLSv1.2'  // Force TLS 1.2
  }
});

Python (psycopg2):

python

import psycopg2
import ssl

ssl_context = ssl.SSLContext(ssl.PROTOCOL_TLSv1_2)
conn = psycopg2.connect(
    host='db.example.com',
    user='user',
    password='password',
    sslmode='require',
    sslrootcert='/path/to/ca.crt'
)

6Test the connection with openssl s_client

Use OpenSSL to test if your client and server can negotiate a common TLS version:

bash

openssl s_client -connect db.example.com:5432 -starttls postgres

Look for output like:

bash

SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : ECDHE-RSA-AES256-GCM-SHA384
    Session-ID: ...

If the connection fails, you'll see:

bash

no ciphers available
error:...

This confirms the TLS version mismatch. If successful, it proves a common TLS version exists.

7Check for proxy or firewall interference

If updating client and server TLS versions doesn't help, verify that proxies, load balancers, or firewalls aren't interfering:

bash

# Test direct connection (if possible)
telnet db.example.com 5432

# Test connection through proxy/jumphost
telnet proxy.internal:5432

# Verify firewall rules allow SSL traffic
sudo ufw status | grep 5432
# or
sudo iptables -L -n | grep 5432

Some firewalls or proxies split SSL frames or buffer handshake packets incorrectly. If this is the case:
- Whitelist the PostgreSQL port (5432) for direct traffic
- Use a tunnel or VPN instead of a proxy
- Contact your network administrator to allow unmodified SSL passthrough

8Verify certificate validity (if using client certs)

If your connection uses client-side certificates, verify they're valid and match the server's requirements:

bash

# Check certificate expiration
openssl x509 -in /path/to/client.crt -text -noout | grep -A2 'Validity'

# Check certificate format
file /path/to/client.crt

# Verify certificate chain
openssl verify -CAfile /path/to/ca.crt /path/to/client.crt

Expired or mismatched certificates can cause SSL handshake failures. Regenerate certificates if needed and ensure the server's ssl_cert_file and ssl_key_file point to valid files.

How to fix could not accept SSL connection: wrong version number in PostgreSQL

What this error means

Typical symptoms

Common causes

How to fix "could not accept SSL connection: wrong version number"

Advanced notes

Related errors

Official resources & further reading