Skip to content

Commit 0154d35

Browse files
committed
fix(quaint): set TLS 1.2 minimum on macOS to prevent P1011 bad protocol version
macOS Security framework defaults to TLS 1.0 which causes "bad protocol version" errors when connecting to PostgreSQL servers requiring TLS 1.2+ (e.g., Ubicloud Managed Postgres #29600). Add conditional platform guard so only macOS builds enforce TLS 1.2 minimum; Linux/Windows unchanged.
1 parent 1171e96 commit 0154d35

2 files changed

Lines changed: 10 additions & 0 deletions

File tree

quaint/Cargo.toml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -52,6 +52,8 @@ postgresql-native = [
5252
"dep:lru-cache",
5353
"dep:byteorder",
5454
"dep:tokio-tungstenite",
55+
"tokio-util/compat",
56+
"tokio-util/io-util",
5557
]
5658
postgresql = []
5759

quaint/src/connector/postgres/native/mod.rs

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -921,6 +921,14 @@ impl MakeTlsConnectorManager {
921921
if let Some(identity) = auth.identity.0 {
922922
tls_builder.identity(identity);
923923
}
924+
925+
// Configure TLS minimum version for macOS (Security framework defaults to TLS 1.0)
926+
// This prevents "bad protocol version" errors when connecting to PostgreSQL
927+
// servers that require TLS 1.2+ (e.g., managed cloud databases like Ubicloud)
928+
#[cfg(target_os = "macos")]
929+
{
930+
tls_builder.min_protocol_version(Some(native_tls::Protocol::Tlsv12));
931+
}
924932
}
925933

926934
let tls_connector = MakeTlsConnector::new(tls_builder.build()?);

0 commit comments

Comments
 (0)