Rails + PostgreSQL SSL decryption failure

Question

I have an app running on my production server that uses the pg gem for talking to a Postgres database. Postgres is running on the default port, and is behind a firewall - so it's not accessible from anything but localhost. I haven't configured Postgres to do anything SSL-related.

I'm accessing the Rails app via SSL, and the certificate is signed for another domain, so the first time you hit it, a certificate error is presented...but that's the only thing SSL-related that's weird.

And yet, I'm seeing this intermittently in my Rails logs (accompanied by a 500 error in the browser when it happens):

Started GET "/admin/pages" for <xxx.xxx.xxx.xxx> at 2012-02-02 01:52:03 -0500
Processing by PagesController#index as HTML
Completed 500 Internal Server Error in 4ms

ActiveRecord::StatementInvalid (PGError: SSL error: decryption failed or bad 
record mac
: SELECT "pages".* FROM "pages" ):
  app/controllers/pages_controller.rb:36:in `index'

What the hell?

araqnid · Accepted Answer · 2012-02-02 12:28:44Z

12

If the database is running on localhost only, turn SSL off: it's not really useful to encrypt a local connection. Either set ssl=false in postgresql.conf (and restart the db server) or tell your client not to use SSL while connecting. Some installations configure PostgreSQL to use SSL by default.

answered Feb 2, 2012 at 12:28

araqnid

135k25 gold badges164 silver badges139 bronze badges

Sign up to request clarification or add additional context in comments.

5 Comments

Jeroen Dierckx Over a year ago

For the record: i tried fixing this by turning off SSL renegotiation as proposed in other threads, but finally only turning off SSL as stated by araqnid worked for me. Bummer because i wanted to use the database server for remote serving as well :( Let's hope for a patch or an update that fixes this soon.

araqnid Over a year ago

@JeroenDierckx: you can use "hostnossl" and "hostssl" in the pg_hba.conf file to enable/disable SSL based on IP range, so that your local clients don't use SSL but your remote clients do.

Jeroen Dierckx Over a year ago

@araqnid Thanks for the tip, very useful! But i expect that the SSL reneg bug will still rear its head when connecting from a remote machine.

coorasse Over a year ago

That's ok if in localhost. But how can I solve if I'm not on lacolhost and I haven't control on the Database server?

Ivan Black Over a year ago

Thanks! ssl=false in postgresql.conf works well.

pymkin · Accepted Answer · 2013-10-25 10:14:38Z

If you look at your PostgreSQL logs you should find the same error. You should note that by default, after installing postgresql you will have the following lines in your postgresql.conf:

ssl = true
ssl_cert_file = '/etc/ssl/certs/ssl-cert-snakeoil.pem'
ssl_key_file = '/etc/ssl/private/ssl-cert-snakeoil.key'

Changing these requires you to restart postgresql, which may not be a good idea on your production system, since it will disrupt your service.

If you prefer to reload postgresql, you can make changes to the pg_hba.conf instead: by using the hostnossl directive.

Since you're using the pg gem, you can also force your app to connect without ssl, by adding this line to your config/database.yml:

sslmode = disable

In any case, you should probably adjust your postgresql configuration to use proper ssl certificates and not snakeoil, if you're ever going to need an encrypted connection to your database.

Collectives™ on Stack Overflow

Rails + PostgreSQL SSL decryption failure

2 Answers 2

5 Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

5 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related