SSL error: tlsv1 alert no application protocol (Docker Image dpage/pgadmin4:8.13 and later / runs fine on :8.12 and beyond)

[mkarg]

Bug Description
To administer my PostgreSQL 17 cluster, I am running @dpage's Docker Image dpage/pgadmin4 using SSL mode: required via TLS (terminated by Traefik 3 proxy). Up to tag 8.12 everything works fine! Since tag 8.13 the error message SSL error: tlsv1 alert no application protocol is shown when trying to connect.

To Reproduce

1. docker run dpage/pgadmin
2. Login in to PGAdmin.
3. Connect to a PostgreSQL 17 cluster using SSL mode: required via Proxy-terminated TLS

Expected behavior
Login should succeed without error message.

Error message
SSL error: tlsv1 alert no application protocol

Desktop (please complete the following information):

• OS: Linux
• Mode: Server
• Browser (if running in server mode): Firefox
• Package type: Docker Image dpage/pgadmin4:8.13 and later tags

Additional context
Works fine in tag 8.12, fails in tags 8.13, 8.14, latest and snapshot

[yogeshmahajan-1903]

@mkarg
Can you please share complete docker compose config file for pgadmin, postgres, traefik ?

[mkarg]

@mkarg Can you please share complete docker compose config file for pgadmin, postgres, traefik ?

If you quickly need a live machine to run some tests against, fee free to connect to my personal PostgreSQL 17 instance running at postgres.headcrashing.eu:5432 (TLS required).

I stripped the full compose file from everything that has nothing to do with PG/PGAdmin/Trafik, and this is what is left over:

services:
  postgres:
    restart: unless-stopped
    image: postgres:17
    shm_size: 256m
    environment:
      - "POSTGRES_PASSWORD=your-password-here"
      - "PGDATA=/var/lib/postgresql/data/pgdata"
    labels:
      - "traefik.enable=true"
      - "traefik.tcp.routers.postgres.rule=HostSNI(`*`)"
      - "traefik.tcp.routers.postgres.entrypoints=postgres"
      - "traefik.tcp.routers.postgres.service=postgres"
      - "traefik.tcp.routers.postgres.tls=true"
      - "traefik.tcp.routers.postgres.tls.certresolver=letsencrypt"
      - "traefik.tcp.routers.postgres.tls.domains[0].main=your-domain-here"
      - "traefik.tcp.services.postgres.loadbalancer.server.port=5432"
  traefik:
    restart: unless-stopped
    image: traefik:3.2
    volumes:
      - type: bind
        source: /var/run/docker.sock
        target: /var/run/docker.sock
    ports:
      - "80:80"
      - "443:443/tcp"
      - "443:443/udp"
      - "5432:5432"
  pgadmin:
    restart: unless-stopped
    image: dpage/pgadmin4:8.14
    environment:
      - PGADMIN_DEFAULT_EMAIL=your-email-here
      - PGADMIN_DEFAULT_PASSWORD=your-password-here
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.pgadmin.rule=Host(`your-hostname-here`)"
      - "traefik.http.routers.pgadmin.entrypoints=websecure"

Note that you cannot run this composition unless you explicitly provide static Traefik configuration, e. g.:

providers:
  docker:
    exposedbydefault: false
entryPoints:
  web:
    address: ":80"
  websecure:
    address: ":443"
    http3: {}
    http:
      tls:
        certResolver: letsencrypt
        domains:
          - main: your-domain-here
  postgres:
    address: ":5432"

[yogeshmahajan-1903]

@mkarg
Can you please provide screenshot for you server properties? What all pararmeters are being sent in connection string?

[mkarg]

@mkarg Can you please provide screenshot for you server properties? What all pararmeters are being sent in connection string?

I just configure the following but keep PGAdmin's defaults for all the rest:

• [General] Name: (arbitrary)
• [Connection] Host name/address: postgres.headcrashing.eu
• [Connection] Username, Password: (irrelevant, as connection fails before checking credentials)
• [Parameters] SSL mode: require

Screenshots taken from functional connection using PGAdmin 8.12:

[pravesh-sharma]

Hi @mkarg,

According to your screenshot, you have not provided the certificates in the server dialog parameters tab because we can see the default placeholders provided by pgAdmin.

[mkarg]

According to your screenshot, you have not provided the certificates in the server dialog parameters tab because we can see the default placeholders provided by pgAdmin.

Correct, and that is fine and intentional. I never provided any certificates in the connection dialog, neither in the working 8.12 and earlier, nor in the failing 8.13 or later, as the TLS connection is secured by Let's Encrypt, which typically is supported by all clients out-of-the-box (and again, it does work fine with 8.12 and earlier, still!). Does your answer imply that since 8.13 and later one must manually download the Let's Encrypt public certificate...? That would be weird, as the benefit of Let's Encrypt solely is that nobody has to do that, actually...! 🤔