tortoise / tortoise/tortoise-orm

Rejected SSL upgrade error when trying to disable SSL

Open
#1,098 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Python
Stars
5.6k
Forks
516
Avg merge
2d 21h
Merged PRs (30d)
9

Description

Describe the bug
When using the FastAPI, register_tortoise method using the config arg to disable SSL using https://tortoise-orm.readthedocs.io/en/latest/databases.html#passing-in-custom-ssl-certificates, the following error is displayed when the server does not support SSL at all (docker). It worked fine when SSL was supported by the postgres instance:
ERROR: Traceback (most recent call last): File "/home/tin/Code/crowdprivy/crowdprivy/backend/.venv/lib/python3.10/site-packages/starlette/routing.py", line 621, in lifespan async with self.lifespan_context(app): File "/home/tin/Code/crowdprivy/crowdprivy/backend/.venv/lib/python3.10/site-packages/starlette/routing.py", line 518, in __aenter__ await self._router.startup() File "/home/tin/Code/crowdprivy/crowdprivy/backend/.venv/lib/python3.10/site-packages/starlette/routing.py", line 598, in startup await handler() File "/home/tin/Code/crowdprivy/crowdprivy/backend/.venv/lib/python3.10/site-packages/tortoise/contrib/fastapi/__init__.py", line 93, in init_orm await Tortoise.init(config=config, config_file=config_file, db_url=db_url, modules=modules) File "/home/tin/Code/crowdprivy/crowdprivy/backend/.venv/lib/python3.10/site-packages/tortoise/__init__.py", line 598, in init await cls._init_connections(connections_config, _create_db) File "/home/tin/Code/crowdprivy/crowdprivy/backend/.venv/lib/python3.10/site-packages/tortoise/__init__.py", line 390, in _init_connections await connection.create_connection(with_db=True) File "/home/tin/Code/crowdprivy/crowdprivy/backend/.venv/lib/python3.10/site-packages/tortoise/backends/asyncpg/client.py", line 103, in create_connection self._pool = await asyncpg.create_pool(None, password=self.password, **self._template) File "/home/tin/Code/crowdprivy/crowdprivy/backend/.venv/lib/python3.10/site-packages/asyncpg/pool.py", line 413, in _async__init__ await self._initialize() File "/home/tin/Code/crowdprivy/crowdprivy/backend/.venv/lib/python3.10/site-packages/asyncpg/pool.py", line 441, in _initialize await first_ch.connect() File "/home/tin/Code/crowdprivy/crowdprivy/backend/.venv/lib/python3.10/site-packages/asyncpg/pool.py", line 133, in connect self._con = await self._pool._get_new_connection() File "/home/tin/Code/crowdprivy/crowdprivy/backend/.venv/lib/python3.10/site-packages/asyncpg/pool.py", line 511, in _get_new_connection con = await connection.connect( File "/home/tin/Code/crowdprivy/crowdprivy/backend/.venv/lib/python3.10/site-packages/asyncpg/connection.py", line 2085, in connect return await connect_utils._connect( File "/home/tin/Code/crowdprivy/crowdprivy/backend/.venv/lib/python3.10/site-packages/asyncpg/connect_utils.py", line 895, in _connect raise last_error File "/home/tin/Code/crowdprivy/crowdprivy/backend/.venv/lib/python3.10/site-packages/asyncpg/connect_utils.py", line 881, in _connect return await _connect_addr( File "/home/tin/Code/crowdprivy/crowdprivy/backend/.venv/lib/python3.10/site-packages/asyncpg/connect_utils.py", line 776, in _connect_addr return await __connect_addr(params, timeout, False, *args) File "/home/tin/Code/crowdprivy/crowdprivy/backend/.venv/lib/python3.10/site-packages/asyncpg/connect_utils.py", line 825, in __connect_addr tr, pr = await compat.wait_for(connector, timeout=timeout) File "/home/tin/Code/crowdprivy/crowdprivy/backend/.venv/lib/python3.10/site-packages/asyncpg/compat.py", line 66, in wait_for return await asyncio.wait_for(fut, timeout) File "/home/tin/.pyenv/versions/3.10.2/lib/python3.10/asyncio/tasks.py", line 445, in wait_for return fut.result() File "/home/tin/Code/crowdprivy/crowdprivy/backend/.venv/lib/python3.10/site-packages/asyncpg/connect_utils.py", line 699, in _create_ssl_connection do_ssl_upgrade = await pr.on_data ConnectionError: PostgreSQL server at "127.0.0.1:5432" rejected SSL upgrade

To Reproduce
ssl_context = create_default_context() ssl_context.check_hostname = False ssl_context.verify_mode = ssl.CERT_NONE tortoise_config = { 'connections': { # Dict format for connection 'default': { 'engine': 'tortoise.backends.asyncpg', 'credentials': { 'host': '127.0.0.1', 'port': '5432', 'user': 'postgres', 'password': 'postgres', 'database': 'postgres', "ssl": ssl_context } }, }, 'apps': { 'models': { 'models': ["models.models", "aerich.models"], # If no default_connection specified, defaults to 'default' 'default_connection': 'default', } } }

Expected behavior
Successful connection without SSL whether or not the postgres instance supports SSL.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the asyncpg connection path shown in tortoise/backends/asyncpg/client.py and the Tortoise.init call used by FastAPI's register_tortoise. Reproduce the configuration against a PostgreSQL server without SSL, then verify that the connection succeeds both when SSL is supported and when it is rejected.

Written by the indexing model from the issue text.

Assessment

Tech stack
fastapi, postgresql, python
Domain
database
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.