Kong migrations fail with PostgreSQL SSL handshake error despite successful psql SSL connection

[YupaTT]

Hello everyone,

I’m trying to run the Kong migrations bootstrap command using the official Kong Docker image (version 3.6.1) connecting to a PostgreSQL 15 server with SSL enabled.

I set the environment variables like this:

• KONG_DATABASE=postgres
• KONG_PG_HOST=dev-postgresql-15.example.com
• KONG_PG_PORT=5432
• KONG_PG_USER=user-postgresql-postgres-kong-kGKs3
• KONG_PG_PASSWORD=w7M5HWLCz0v7p
• KONG_PG_DATABASE=kong
• KONG_PG_SSL=on
• KONG_PG_SSL_VERIFY=off

When I run the migration command:

    docker run --rm \
      -e KONG_DATABASE=postgres \
      -e KONG_PG_HOST=dev-postgresql-15.example.com \
      -e KONG_PG_PORT=5432 \
      -e KONG_PG_USER=user-postgresql-postgres-kong-kGKs3 \
      -e KONG_PG_PASSWORD=w7M5HWLCz0v7p \
      -e KONG_PG_DATABASE=kong \
      -e KONG_PG_SSL=on \
      -e KONG_PG_SSL_VERIFY=off \
      kong:3.6 kong migrations bootstrap --vv

I get this error:

          2025/07/02 14:44:01 [verbose] SSL enabled on admin, no custom certificate set: using default certificates2025/07/02 14:44:01 [error] 1298#0: *2 peer closed connection in SSL handshake, context: ngx.timer
          Error: 
          /usr/local/share/lua/5.1/kong/cmd/migrations.lua:101: [PostgreSQL error] failed to retrieve PostgreSQL server_version_num: handshake failed
          stack traceback:
	          [C]: in function 'assert'
	          /usr/local/share/lua/5.1/kong/cmd/migrations.lua:101: in function 'cmd_exec'
	          /usr/local/share/lua/5.1/kong/cmd/init.lua:31: in function </usr/local/share/lua/5.1/kong/cmd/init.lua:31>
	          [C]: in function 'xpcall'
	          /usr/local/share/lua/5.1/kong/cmd/init.lua:31: in function </usr/local/share/lua/5.1/kong/cmd/init.lua:15>
	          (command line -e):7: in function 'inline_gen'
	          init_worker_by_lua(nginx.conf:130):44: in function <init_worker_by_lua(nginx.conf:130):43>
	          [C]: in function 'xpcall'
	          init_worker_by_lua(nginx.conf:130):52: in function <init_worker_by_lua(nginx.conf:130):50>
          
          2025/07/02 14:44:01 [verbose] generating admin SSL certificate (/usr/local/kong/ssl/admin-kong-default.crt) and key (/usr/local/kong/ssl/admin-kong-default.key) for listener
          2025/07/02 14:44:01 [verbose] generating admin SSL certificate (/usr/local/kong/ssl/admin-kong-default-ecdsa.crt) and key (/usr/local/kong/ssl/admin-kong-default-ecdsa.key) for listener
          2025/07/02 14:44:01 [verbose] SSL enabled on admin_gui, no custom certificate set: using default certificates
          2025/07/02 14:44:01 [verbose] generating admin_gui SSL certificate (/usr/local/kong/ssl/admin-gui-kong-default.crt) and key (/usr/local/kong/ssl/admin-gui-kong-default.key) for listener
          2025/07/02 14:44:01 [verbose] generating admin_gui SSL certificate (/usr/local/kong/ssl/admin-gui-kong-default-ecdsa.crt) and key (/usr/local/kong/ssl/admin-gui-kong-default-ecdsa.key) for listener
          2025/07/02 14:44:01 [verbose] generating trusted certs combined file in /usr/local/kong/.ca_combined

The PostgreSQL server is definitely reachable and accepts SSL connections. In fact, connecting with psql using SSL works perfectly:

        psql "sslmode=require host=dev-postgresql-15.example.com port=5432 user=user-postgresql-postgres-kong-kGKs3 password=w7M5HWLCz0v7p dbname=kong"
        psql (16.9 (Debian 16.9-1.pgdg120+1), server 15.13 (Debian 15.13-1.pgdg120+1))
        SSL connection (protocol: TLSv1.3, cipher: TLS_AES_128_GCM_SHA256, compression: off)
        Type "help" for help.
        
        kong=# exit

This connects successfully over SSL without any issues.

Has anyone encountered this problem before or knows what could cause Kong’s SSL handshake with PostgreSQL to fail while psql works fine?

Thanks in advance for any help or suggestions!

[StarlightIbuki]

Are you using a self-signed certificate? You could add that to the trusted CA of Kong