Tell me more ×
Stack Overflow is a question and answer site for professional and enthusiast programmers. It's 100% free, no registration required.
up vote 5 down vote favorite
1

I have an app running on my production server that uses the pg gem for talking to a Postgres database. Postgres is running on the default port, and is behind a firewall - so it's not accessible from anything but localhost. I haven't configured Postgres to do anything SSL-related.

I'm accessing the Rails app via SSL, and the certificate is signed for another domain, so the first time you hit it, a certificate error is presented...but that's the only thing SSL-related that's weird.

And yet, I'm seeing this intermittently in my Rails logs (accompanied by a 500 error in the browser when it happens):

Started GET "/admin/pages" for <xxx.xxx.xxx.xxx> at 2012-02-02 01:52:03 -0500
Processing by PagesController#index as HTML
Completed 500 Internal Server Error in 4ms

ActiveRecord::StatementInvalid (PGError: SSL error: decryption failed or bad 
record mac
: SELECT "pages".* FROM "pages" ):
  app/controllers/pages_controller.rb:36:in `index'

What the hell?

share|improve this question

2 Answers

up vote 8 down vote accepted

If the database is running on localhost only, turn SSL off: it's not really useful to encrypt a local connection. Either set ssl=false in postgresql.conf (and restart the db server) or tell your client not to use SSL while connecting. Some installations configure PostgreSQL to use SSL by default.

share|improve this answer
 
Nice, thanks - that seems to have done the trick! –  codykrieger Feb 2 '12 at 18:16
 
+1 - Thanks so much! This helped me too :-) –  Topher Fangio Oct 16 '12 at 12:35
 
For the record: i tried fixing this by turning off SSL renegotiation as proposed in other threads, but finally only turning off SSL as stated by araqnid worked for me. Bummer because i wanted to use the database server for remote serving as well :( Let's hope for a patch or an update that fixes this soon. –  Jeroen Dierckx Oct 17 '12 at 8:41
 
@JeroenDierckx: you can use "hostnossl" and "hostssl" in the pg_hba.conf file to enable/disable SSL based on IP range, so that your local clients don't use SSL but your remote clients do. –  araqnid Oct 17 '12 at 9:49
 
@araqnid Thanks for the tip, very useful! But i expect that the SSL reneg bug will still rear its head when connecting from a remote machine. –  Jeroen Dierckx Oct 17 '12 at 9:52
show 1 more comments
up vote 0 down vote

If you look at your PostgreSQL logs you should find the same error. You should note that by default, after installing postgresql you will have the following lines in your postgresql.conf:

ssl = true
ssl_cert_file = '/etc/ssl/certs/ssl-cert-snakeoil.pem'
ssl_key_file = '/etc/ssl/private/ssl-cert-snakeoil.key'

Changing these requires you to restart postgresql, which may not be a good idea on your production system, since it will disrupt your service.

If you prefer to reload postgresql, you can make changes to the pg_hba.conf instead: by using the hostnossl directive.

Since you're using the pg gem, you can also force your app to connect without ssl, by adding this line to your config/database.yml:

sslmode = disable

In any case, you should probably adjust your postgresql configuration to use proper ssl certificates and not snakeoil, if you're ever going to need an encrypted connection to your database.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.