How to fix SSL error: certificate does not match host name in PostgreSQL

PostgreSQLINTERMEDIATEHIGHUpdated Dec 29, 2025· 151 views

This SSL error occurs when the hostname in your connection string doesn't match the hostname in the PostgreSQL server's SSL certificate. The mismatch happens when using verify-full SSL mode, which validates both the certificate chain and the hostname.

Quick fix

Fixes SSL error: certificate does not match host name

# Usually located at $PGDATA/server.crt
openssl x509 -in /var/lib/postgresql/15/main/server.crt -text -noout | grep -A 1 "Subject Alternative Name"
  1. Identify the hostname in the server certificate
  2. Update your connection string to use the correct hostname
  3. Verify DNS resolution matches the hostname
  4. Test the connection with verbose SSL output
postgresql — error
# Usually located at $PGDATA/server.crt
openssl x509 -in /var/lib/postgresql/15/main/server.crt -text -noout | grep -A 1 "Subject Alternative Name"
SSL error: certificate does not match host name

What this error means

When PostgreSQL's SSL mode is set to `verify-full`, the client not only verifies that the certificate is signed by a trusted Certificate Authority, but also validates that the certificate's Common Name (CN) or Subject Alternative Name (SAN) matches the hostname you're connecting to. If there's a mismatch—for example, connecting to an IP address when the certificate only has a hostname, or using an alias when the certificate specifies the FQDN—this error is raised as a security measure to prevent man-in-the-middle attacks.

Typical symptoms

  • Connection fails with 'SSL error: certificate does not match host name'
  • Works when connecting with sslmode=require but fails with sslmode=verify-full
  • Connections work from one environment but not another (e.g., local vs cloud)
  • Certificate validation succeeds but hostname check fails
  • Application cannot connect to managed PostgreSQL services (AWS RDS, Azure, Google Cloud SQL)

Common causes

  1. Connecting to a server via IP address when the certificate only has a hostname
  2. Using a hostname alias or internal name that differs from the certificate's CN/SAN
  3. Certificate only includes the short hostname but you're connecting with FQDN (or vice versa)
  4. Connecting to localhost when the certificate is issued to the actual server FQDN
  5. Self-signed certificate was generated with different hostname than the one being used
  6. DNS resolves to a different hostname than expected

How to fix "SSL error: certificate does not match host name"

1Identify the hostname in the server certificate

First, find out what hostname is actually in the PostgreSQL server's SSL certificate. If you have access to the server, check the certificate file:

bash
# Usually located at $PGDATA/server.crt
openssl x509 -in /var/lib/postgresql/15/main/server.crt -text -noout | grep -A 1 "Subject Alternative Name"

Or extract the Common Name:

bash
openssl x509 -in /var/lib/postgresql/15/main/server.crt -noout -subject

Output will show something like:
- CN=my-database.example.com
- DNS:my-database.example.com, DNS:*.example.com

Note the exact hostname(s) listed—this is what you must connect with.

2Update your connection string to use the correct hostname

Change your connection string to use the exact hostname from the certificate.

Incorrect (using IP or different hostname):

bash
psql -h 192.168.1.50 -U postgres -d mydb -W
# or
psql -h localhost -U postgres -d mydb -W

Correct (using the certificate's hostname):

bash
psql -h my-database.example.com -U postgres -d mydb -W

For applications, update your connection string:

bash
# Before
postgresql://user:password@192.168.1.50:5432/mydb?sslmode=verify-full

# After
postgresql://user:password@my-database.example.com:5432/mydb?sslmode=verify-full
3Verify DNS resolution matches the hostname

Ensure that the hostname you're using resolves to the correct IP address:

bash
nslookup my-database.example.com
# or
dig my-database.example.com

Compare the resolved IP address with your server's actual IP. If they don't match, update your DNS records or use a hostname that does resolve correctly.

If you're in a private network or using /etc/hosts, verify the entry:

bash
grep my-database /etc/hosts

Update if needed:

bash
echo "192.168.1.50    my-database.example.com" | sudo tee -a /etc/hosts
4Test the connection with verbose SSL output

Test the connection using psql with verbose output to see exactly what's happening:

bash
psql -h my-database.example.com -U postgres -d mydb -W \
  sslmode=verify-full \
  sslrootcert=/path/to/ca-cert.pem

For Node.js applications using node-postgres or similar libraries:

javascript
const client = new Client({
  host: 'my-database.example.com',
  port: 5432,
  user: 'postgres',
  password: 'password',
  database: 'mydb',
  ssl: {
    rejectUnauthorized: true,
    ca: fs.readFileSync('/path/to/ca-cert.pem', 'utf8'),
  },
});

If you get the error again, the hostname in the connection is still wrong.

5For managed PostgreSQL services (AWS RDS, Azure, Google Cloud SQL)

Cloud-hosted PostgreSQL services provide a specific endpoint hostname that you must use:

AWS RDS:
- Endpoint: mydb.abc123xyz.us-east-1.rds.amazonaws.com
- Use this hostname exactly as provided
- Download the RDS CA certificate

bash
psql -h mydb.abc123xyz.us-east-1.rds.amazonaws.com -U postgres -d mydb \
  sslmode=verify-full \
  sslrootcert=rds-ca-2023-root.pem

Azure Database for PostgreSQL:
- Endpoint: mydb.postgres.database.azure.com
- SSL is mandatory; obtain the DigiCert certificate from Azure portal

Google Cloud SQL:
- Endpoint: 1.2.3.4:5432 (public IP) or private IP in same VPC
- For SSL, use sslmode=require if IP-based, or sslmode=verify-full if using Cloud Proxy
- Download the server certificate from Cloud Console

Never use IP addresses with sslmode=verify-full on managed services—use their provided hostname.

6Temporarily reduce SSL verification if needed (development only)

If you're in development and must connect via IP or alias, you can reduce SSL verification, but this is not recommended for production:

bash
# Verify certificate chain but skip hostname check
psql -h 192.168.1.50 -U postgres -d mydb -W sslmode=verify-ca

# Or, encrypt without verification (least secure)
psql -h 192.168.1.50 -U postgres -d mydb -W sslmode=require

For Node.js:

javascript
const client = new Client({
  host: '192.168.1.50',
  ssl: {
    rejectUnauthorized: false, // Skip hostname/chain verification
  },
});

This leaves you vulnerable to man-in-the-middle attacks. Fix the hostname/certificate mismatch instead.

Advanced notes

Certificate Subject Alternative Names (SAN): Modern certificates use the SAN extension instead of Common Name. A certificate might list multiple hostnames like:

bash
DNS:my-database.example.com
DNS:db.example.com
DNS:*.example.com
IP:192.168.1.50

Your connection hostname must match one of these exactly (wildcards are honored for partial matches, but IP addresses must match exactly).

Wildcards: A certificate with DNS:*.example.com will match my-database.example.com but NOT sub.my-database.example.com (multi-level wildcards are invalid) or example.com itself.

Self-Signed Certificates: If your PostgreSQL server uses a self-signed certificate and you regenerate it with a different hostname, existing clients will fail. Either regenerate the certificate with all required hostnames, or regenerate with the new hostname and update all clients.

SSL Version Issues: Ensure your PostgreSQL server's SSL certificate and client libraries support the same TLS versions (TLS 1.2+). Older distributions may have compatibility issues.

pg_dump/pg_restore: These tools also respect SSL mode and certificate validation. If you get the error in backups/restores:

bash
pg_dump -h my-database.example.com -U postgres --require-password \
  -v | gzip > backup.sql.gz

Kubernetes/Docker: In containerized environments, use the service DNS name from your orchestrator (e.g., postgres.default.svc.cluster.local in Kubernetes, or the container name in Docker networks), not the container IP.

Frequently asked questions

What does "SSL error: certificate does not match host name" mean?
When PostgreSQL's SSL mode is set to verify-full, the client not only verifies that the certificate is signed by a trusted Certificate Authority, but also validates that the certificate's Common Name (CN) or Subject Alternative Name (SAN) matches the hostname you're connecting to. If there's a mismatch—for example, connecting to an IP address when the certificate only has a hostname, or using an alias when the certificate specifies the FQDN—this error is raised as a security measure to prevent man-in-the-middle attacks.
How do I fix "SSL error: certificate does not match host name"?
This SSL error occurs when the hostname in your connection string doesn't match the hostname in the PostgreSQL server's SSL certificate. The mismatch happens when using verify-full SSL mode, which validates both the certificate chain and the hostname.
What causes "SSL error: certificate does not match host name"?
Connecting to a server via IP address when the certificate only has a hostname Using a hostname alias or internal name that differs from the certificate's CN/SAN Certificate only includes the short hostname but you're connecting with FQDN (or vice versa)
Is the "SSL error: certificate does not match host name" error serious?
Yes. This is a high-severity error that usually blocks work until it is fixed, but the steps above resolve it.

Official resources & further reading