Cannot use 'verify-full' when using an external PostgreSQL Database with Red Hat Single Sign-On (RH SSO) deployed in Red Hat OpenShift Container Platform (OCP)
Issue
With the RH SSO in OCP, we cannot activate the verify-full TLS policy when using an external PostgreSQL, receiving the following error:
[0m[33m20:07:52,359 WARN [org.jboss.jca.core.connectionmanager.pool.strategy.OnePool] (MSC service thread 1-2) IJ000604: Throwable while attempting to get a new connection: null: javax.resource.ResourceException: IJ031084: Unable to create connection
at ...
Caused by: org.postgresql.util.PSQLException: The hostname keycloak-postgresql.<NAMESPACE>.svc.cluster.local could not be verified.
at org.postgresql@42.2.3//org.postgresql.ssl.MakeSSL.convert(MakeSSL.java:93)
at org.postgresql@42.2.3//org.postgresql.core.v3.ConnectionFactoryImpl.enableSSL(ConnectionFactoryImpl.java:384)
at org.postgresql@42.2.3//org.postgresql.core.v3.ConnectionFactoryImpl.openConnectionImpl(ConnectionFactoryImpl.java:156)
at org.postgresql@42.2.3//org.postgresql.core.ConnectionFactory.openConnection(ConnectionFactory.java:49)
at org.postgresql@42.2.3//org.postgresql.jdbc.PgConnection.<init>(PgConnection.java:201)
at org.postgresql@42.2.3//org.postgresql.Driver.makeConnection(Driver.java:454)
at org.postgresql@42.2.3//org.postgresql.Driver.connect(Driver.java:256)
Environment
- Red Hat Single Sign-On (RH SSO)
- 7.X
- Red Hat OpenShift Container Platform (OCP)
- 3.11
- 4.X
Subscriber exclusive content
A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.