Problem connecting flyway with a postgres through ssl

Question

I have a java application that was previously running with Postgres JDBC dependency version 42.2.5 and flyway version 5.2.1. These versions were coming from spring-boot-dependencies project. In this case, we were using 2.1.0.RELEASE version.

So, I had the task of upgrading those dependencies. And I did so. spring-boot-dependencies is now at 2.7.8. Flyway version is now at 7.15.0. I kept postgres in the old version for now, because of the error described below.

The thing is that after upgrading if I keep the property spring.flyway.enabled set to true, the application won't start. It keeps complaining about a valid certificate:

Caused by: org.flywaydb.core.internal.exception.FlywaySqlException: Unable to obtain connection from database: FATAL: connection requires a valid client certificate
------------------------------------------------------------------------------------------------
SQL State  : 28000
Error Code : 0
Message    : FATAL: connection requires a valid client certificate

        at org.flywaydb.core.internal.jdbc.JdbcUtils.openConnection(JdbcUtils.java:67)
        at org.flywaydb.core.internal.jdbc.JdbcConnectionFactory.<init>(JdbcConnectionFactory.java:70)
        at org.flywaydb.core.Flyway.execute(Flyway.java:504)
        at org.flywaydb.core.Flyway.migrate(Flyway.java:170)
        at org.springframework.boot.autoconfigure.flyway.FlywayMigrationInitializer.afterPropertiesSet(FlywayMigrationInitializer.java:66)
        at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.invokeInitMethods(AbstractAutowireCapableBeanFactory.java:1863)
        at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.initializeBean(AbstractAutowireCapableBeanFactory.java:1800)
        ... 38 common frames omitted
Caused by: org.postgresql.util.PSQLException: FATAL: connection requires a valid client certificate
        at org.postgresql.core.v3.ConnectionFactoryImpl.doAuthentication(ConnectionFactoryImpl.java:514)
        at org.postgresql.core.v3.ConnectionFactoryImpl.tryConnect(ConnectionFactoryImpl.java:141)
        at org.postgresql.core.v3.ConnectionFactoryImpl.openConnectionImpl(ConnectionFactoryImpl.java:192)
        at org.postgresql.core.ConnectionFactory.openConnection(ConnectionFactory.java:49)
        at org.postgresql.jdbc.PgConnection.<init>(PgConnection.java:195)
        at org.postgresql.Driver.makeConnection(Driver.java:454)
        at org.postgresql.Driver.connect(Driver.java:256)
        at org.springframework.jdbc.datasource.SimpleDriverDataSource.getConnectionFromDriver(SimpleDriverDataSource.java:144)
        at org.springframework.jdbc.datasource.AbstractDriverBasedDataSource.getConnectionFromDriver(AbstractDriverBasedDataSource.java:205)
        at org.springframework.jdbc.datasource.AbstractDriverBasedDataSource.getConnection(AbstractDriverBasedDataSource.java:169)
        at org.flywaydb.core.internal.jdbc.JdbcUtils.openConnection(JdbcUtils.java:52)
        ... 44 common frames omitted

If I disable flyway, the application starts and can connect to the database.

My properties file looks like this:

spring.datasource.url=jdbc:postgresql://host:5432/db?ssl=true&sslmode=require&sslfactory=org.postgresql.ssl.DefaultJavaSSLFactory
spring.datasource.username=user
spring.datasource.password=

server.ssl.key-store=classpath:certs/keystore-dev.p12
server.ssl.key-store-password=pass
server.ssl.key-store-type=PKCS12
server.ssl.key-alias=app-alias
server.ssl.protocol=TLS
# flyway db migration support
spring.flyway.enabled=true

The connection data is correct since the application starts and connects to the database.

You are probably missing certificate-related stuff within your JDBC url. Check this out stackoverflow.com/questions/56511629/… — Nikolai Shevchenko
– Nikolai Shevchenko, Commented Mar 27, 2023 at 13:36
That's the thing, apparently, just flyway complains about the certificate because when I disable it, the data source is able to establish a connection with the database.So, I believe I'm missing some configuration on flyway — amaurinorato
– amaurinorato, Commented Mar 27, 2023 at 13:41
Well, I finally understood the problem. Basically, when I upgraded from spring 2.1.0-RELEASE to 2.7.15 the error started. So, I began jumping versions until seeing the error. And it happened to be when upgrading from 2.4.2 to 2.4.3. When I see the logs on 2.4.2 the application loads the certs before the flyway tries to apply migrations. On 2.4.3, the certs are loaded after flyway tries to apply the migrations. So, something changed in the way Spring loads configurations classes. Still looking for a solution — amaurinorato
– amaurinorato, Commented Mar 28, 2023 at 12:56

amaurinorato · Accepted Answer · 2023-03-29 18:41:21Z

2

Well, the solution was quite easy after understanding the real problem:

For some reason, I still don’t know why, when upgrading from spring 2.4.2 to 2.4.3 and above, it changed the order of beans loading. So, previously, we had the class DatasourceContextConfiguration, which was responsible for loading the certificates, loaded before flyway tries to connect to the database and apply changes. After the upgrade, flyway started trying to connect to the database first, before we load the certificates. So the fix was basically, finding a way to load this bean, responsible for loading the certificates before the flyway tries to apply the migrations

answered Mar 29, 2023 at 18:41

amaurinorato

811 silver badge11 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Problem connecting flyway with a postgres through ssl

1 Answer 1

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related