cloudflare / cloudflare/developer-platform

🐛 BUG: SECP521R1 not supported for Hyperdrive

Abierto
#7 5 comentarios 0 reacciones 0 asignados Ver en GitHub
Lenguaje dominante
Sin datos de lenguaje
Estrellas
1
Forks
0
Métricas de merge de PR
Sin PR fusionados en 30 d

Descripción

### Which Cloudflare product(s) does this pertain to?

Other

### What versions are you using?

4.4.0 [Wrangler], 16.8 [PostgreSQL]

### What operating system and version are you using?

Windows 10 21H2 (Wrangler) | Alpine 14.2.0 (PostgreSQL)

### Please provide a link to a minimal reproduction

_No response_

### Describe the Bug

SSL support for databases has recently been added to Coolify, but it seems like the signature algorithm provided by CloudFlare Hyperdrive doesn't work with a PostgreSQL docker image with SSL configured by Coolify; Coolify signs the certificates using SECP521R1.

## Steps to reproduce the error
1. Create a PostgreSQL v16 Database on Coolify; uses `postgres:16-alpine` by default
2. Enable SSL and set TLS mode to `require`
3. Start service & proxy database to make it publicly available
4. Copy the public URL and paste onto Wrangler
5. Review the logs on Wrangler and PostgreSQL container

```sh
# wrangler logs
Failed to connect to the provided database: Internal error. [code: 2015]

# postgres16-alpine logs
2025-03-25 19:31:22.565 UTC [872] LOG: could not accept SSL connection: no suitable signature algorithm
```
---

This issue seems to also affect other Docker images such as `postgres:16-bookworm`, and `postgres-15-bookworm`. I haven't bothered testing any other images yet, but it seems like the issues are consistent regardless of the image.

As stated, I assume that this error comes from CF as SECP521R1 may not be supported by CloudFlare. In case if it helps, find below the implementation here: coollabsio/coolify#5027

### Please provide any relevant error logs

_No response_

Guía de contribución

Abrir la guía de contribución

Línea de trabajo

Start by reproducing the connection through Hyperdrive/Wrangler using the PostgreSQL 16 Alpine setup and TLS mode `require`, then compare the Wrangler and PostgreSQL logs. Read the linked Coolify implementation and verify whether SECP521R1 compatibility is the failing boundary; done means the reported connection succeeds or the incompatibility is clearly confirmed and covered by an appropriate regression check.

Escrito por el modelo de indexación a partir del texto del issue.

Evaluación

Stack tecnológico
docker, postgresql
Área
cloud, databases, security
Tipo de issue
Error
Dificultad
4/5
Tiempo estimado
3-5 días
Estado de actividad
Estancado
Claridad
Necesita aclaración
Aptitud para principiantes
25/100

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.