Thread: BUG #16463: Sporadic SSL handshake failures in Windows client

The following bug has been logged on the website:

Bug reference:      16463
Logged by:          Ricardo de Castro Garcia
Email address:      rcastro@stratio.com
PostgreSQL version: 9.5.10
Operating system:   Client: Windows Server 2012 R2     Server: Centos7
Description:

Hi,
we are experiencing an strange issue connecting to a PostgresXL through an
OLEDB connection. After reviewing all the modules and configurations, we
haven't found any clue on what is happening.

We are connecting to a Postgres-XL server from a SQL Server Integration
Services (SSIS, from now) using an OLEDB driver solution developed by
Intellisoft. The PostgresXL server is deployed in a Centos 7 machine with a
PGBouncer pool. 
Monthly, we are facing an issue that consists in connection failures between
SSIS and PGBouncer. The pooler is showing the following error:
ssl3_get_client_certificate:peer did not return a certificate

PGBouncer is rejecting the connection, so PostgresXL server is never
reached. In order to resolve this issue, we have to reinstall the PostgresXL
certificates in the Windows Server. After that, the connection can be
reestablished without any server interventions.

We understand that PostgresXL is barely involved in the issue, however we've
checked all possible causes (server GPOs, certificate chain issues, driver
troubles, operative system certificate management...) and exhausted all the
possibilities. This is why we sent you this mail. ¿is there any known issue
that can match with the problem that we are facing?

Software versions
- Client OS: Windows Server 2012 R2
- Client app: SQL Server Integration Services 2016
- Client driver: Intellisoft OLEDB Server Edition v1.4
- Server OS: Centos 7
- Server pool: PGBouncer: 1.9.0
- Server Postgres: PostgresXL 9.5r1.6

PG Bug reporting form <noreply@postgresql.org> writes:
> We are connecting to a Postgres-XL server from a SQL Server Integration
> Services (SSIS, from now) using an OLEDB driver solution developed by
> Intellisoft. The PostgresXL server is deployed in a Centos 7 machine with a
> PGBouncer pool. 
> Monthly, we are facing an issue that consists in connection failures between
> SSIS and PGBouncer. The pooler is showing the following error:
> ssl3_get_client_certificate:peer did not return a certificate

> PGBouncer is rejecting the connection, so PostgresXL server is never
> reached. In order to resolve this issue, we have to reinstall the PostgresXL
> certificates in the Windows Server. After that, the connection can be
> reestablished without any server interventions.

Weird ... but I'm afraid you have come to the wrong place for help.
This mailing list deals with PG server bugs, and the server seems to
be the one component that is clearly not at fault in your case.

It could be PGBouncer's fault, so I'd suggest inquiring through their
support contact.  (I do not know offhand what that is, but it's not
here.)  But TBH, if reinstalling the identical certificates on the
client machine makes the problem go away, it's hard to conclude that
it's not a client-side bug.

            regards, tom lane