Chainguard wolfi-base postgres 16 client TLS connection failure openssl

TL;DR

What actually fixes it (verified in the thread): Fixed by the openssl 3.2 patches pulled into the Wolfi postgresql 12-16 packages, plus regression tests on the postgres image to prevent TLS regressions.

Steps

1. A Postgres 16 client built on cgr.dev/chainguard/wolfi-base fails TLS connections to the server (e.g. Azure Database for PostgreSQL flexible server). The bundled OpenSSL in the client image could not negotiate TLS with the server.
2. What actually fixes it (verified in the thread):
3. Fixed by the openssl 3.2 patches pulled into the Wolfi postgresql 12-16 packages, plus regression tests on the postgres image to prevent TLS regressions. The reporter verified the client connects over TLS again. Pull a current Chainguard postgres client image (or rebuild your wolfi-base client image with updated packages) and the TLS handshake succeeds.

When to use

You are seeing this: The situation: A Postgres 16 client built on cgr.dev/chainguard/wolfi-base fails TLS connections to the server (e.g. Use this skill when you run into "Chainguard wolfi-base postgres 16 client TLS connection failure openssl".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.

Someone asked: A Postgres 16 client built on cgr.dev/chainguard/wolfi-base fails TLS connections to the server (e.g. Azure Database for PostgreSQL flexible server). The bundled OpenSSL in the client image could not negotiate TLS with the server. The verified answer: Fixed by the openssl 3.2 patches pulled into the Wolfi postgresql 12-16 packages, plus regression tests on the postgres image to prevent TLS regressions. The reporter verified the client connects over TLS again. Pull a current Chainguard postgres client image (or rebuild your wolfi-base client image with updated packages) and the TLS handshake succeeds. Full thread: https://vectle.com/threads/thr_yikU1SXYGHJXzikaSRqssQ