PostgreSQL SSL SYSCALL EOF Analyzer

Threat/Impact Level: HIGH | Exploitability/Downtime Risk: HIGH | Time to Fix: 15–30 mins

TL;DR

• What broke: PostgreSQL's SSL layer received an abrupt EOF — the TCP connection died before the TLS handshake completed or during an active session, caused by cert mismatch, pg_hba.conf rejection, expired certificates, or a load balancer/firewall silently killing idle connections.
• How to fix it: Validate your certificate chain, enforce correct sslmode, fix pg_hba.conf to allow SSL from the client CIDR, and set TCP keepalive parameters on both client and server.
• Sandbox: Use our Client-Side Sandbox above to paste your postgresql.conf, pg_hba.conf, or connection string — it will auto-diagnose the misconfiguration and generate the refactored config.

psql: error: connection to server at "db.prod.internal" (10.0.1.45), port 5432 failed:
SSL SYSCALL error: EOF detected

Error: SSL SYSCALL error: EOF detected
    at Connection.connect (node_modules/pg/lib/connection.js:54)
code: 'ECONNRESET'

How to Fix It

Diagnose First

Run this before changing anything:

# Test raw SSL handshake — bypasses libpq
openssl s_client -connect db.prod.internal:5432 -starttls postgres

# Check cert expiry
echo | openssl s_client -connect db.prod.internal:5432 -starttls postgres 2>/dev/null \
  | openssl x509 -noout -dates

# Check what pg_hba.conf is actually enforcing
psql -U postgres -c "SELECT type, database, user_name, address, auth_method FROM pg_hba_file_rules;"

Fix 1: Certificate Chain / sslmode Mismatch

# Connection string (application config / .env)
- DATABASE_URL="postgresql://app_user:secret@db.prod.internal:5432/appdb?sslmode=disable"
+ DATABASE_URL="postgresql://app_user:secret@db.prod.internal:5432/appdb?sslmode=verify-full&sslrootcert=/etc/ssl/certs/rds-ca-2019-root.pem"

# If using self-signed cert in non-prod:
- DATABASE_URL="postgresql://app_user:secret@db.internal:5432/appdb?sslmode=require"
+ DATABASE_URL="postgresql://app_user:secret@db.internal:5432/appdb?sslmode=verify-ca&sslrootcert=/etc/ssl/private/internal-ca.crt"

Never use sslmode=disable in production. Never use sslmode=require without cert verification — it's encryption without authentication, vulnerable to MITM.

Fix 2: `pg_hba.conf` — Allow SSL from Correct CIDR

# /etc/postgresql/15/main/pg_hba.conf

- hostnossl   appdb   app_user   10.0.1.0/24   scram-sha-256
+ hostssl     appdb   app_user   10.0.1.0/24   scram-sha-256

# Reload config without restart:
# SELECT pg_reload_conf();

Fix 3: TCP Keepalive — Kill the Middlebox Timeout Problem

This is the enterprise-critical fix for AWS RDS, Aurora, Cloud SQL, and any NAT-traversed connection.

# postgresql.conf (server-side)
- #tcp_keepalives_idle = 0
- #tcp_keepalives_interval = 0
- #tcp_keepalives_count = 0
+ tcp_keepalives_idle = 60      # Send keepalive after 60s idle
+ tcp_keepalives_interval = 10  # Retry every 10s
+ tcp_keepalives_count = 6      # Drop after 6 missed probes

# Client-side (libpq connection string or env vars)
- DATABASE_URL="postgresql://user:pass@host:5432/db?sslmode=verify-full"
+ DATABASE_URL="postgresql://user:pass@host:5432/db?sslmode=verify-full&keepalives=1&keepalives_idle=60&keepalives_interval=10&keepalives_count=6"

# PgBouncer — pgbouncer.ini
- ;tcp_keepalive = 0
- ;tcp_keepcnt = 0
- ;tcp_keepidle = 0
- ;tcp_keepintvl = 0
+ tcp_keepalive = 1
+ tcp_keepcnt = 6
+ tcp_keepidle = 60
+ tcp_keepintvl = 10
+ server_idle_timeout = 55     # Must be LESS than ALB/NAT idle timeout
+ client_idle_timeout = 55

Enterprise Best Practice: Enforce SSL in RDS Parameter Group + Rotate Certs Automatically

# Terraform — aws_db_parameter_group
 resource "aws_db_parameter_group" "postgres" {
   name   = "prod-postgres15"
   family = "postgres15"

-  # No SSL enforcement
+  parameter {
+    name  = "rds.force_ssl"
+    value = "1"
+    apply_method = "immediate"
+  }
}

# Use ACM Private CA or AWS-managed RDS cert rotation:
# aws rds modify-db-instance \
#   --db-instance-identifier prod-db \
#   --ca-certificate-identifier rds-ca-rsa2048-g1 \
#   --apply-immediately

💡 Tired of pasting proprietary infrastructure configs into public LLMs? Generic AI interfaces log your company's ARNs, connection strings, and private keys. StackEngine enforces client-side zero-trust boundaries—the sandbox above executes 100% locally in your browser. Drop your broken manifest above to redact secrets locally and synthesize deterministic patch drafts with your own API key.

(For CI/CD pipeline automation, install via npm i -g stackengine).

# .checkov.yml
checks:
  - CKV_AWS_211   # RDS force SSL
  - CKV_AWS_17    # RDS not publicly accessible
  - CKV2_AWS_60   # RDS IAM auth enabled

package postgres.ssl

deny[msg] {
  val := input.env.DATABASE_URL
  contains(val, "sslmode=disable")
  msg := "DATABASE_URL must not use sslmode=disable in production manifests"
}

deny[msg] {
  val := input.env.DATABASE_URL
  not contains(val, "sslmode=verify")
  msg := "DATABASE_URL must use sslmode=verify-full or verify-ca"
}

# Alert fires 30 days before cert expiry
- alert: PostgresSSLCertExpiringSoon
  expr: ssl_certificate_expiry_seconds{job="postgres"} < 2592000
  for: 1h
  labels:
    severity: critical
  annotations:
    summary: "PostgreSQL SSL cert expires in < 30 days on {{ $labels.instance }}"

#!/bin/bash
# ci/check-postgres-ssl.sh
result=$(openssl s_client -connect "$DB_HOST:5432" -starttls postgres \
  -CAfile "$SSL_ROOT_CERT" 2>&1)
if echo "$result" | grep -q "Verify return code: 0"; then
  echo "SSL OK"
else
  echo "SSL HANDSHAKE FAILED" && exit 1
fi