Question

I have an app running on my production server that uses the pg gem for talking to a Postgres database. Postgres is running on the default port, and is behind a firewall – so it’s not accessible from anything but localhost. I haven’t configured Postgres to do anything SSL-related.

I’m accessing the Rails app via SSL, and the certificate is signed for another domain, so the first time you hit it, a certificate error is presented…but that’s the only thing SSL-related that’s weird.

And yet, I’m seeing this intermittently in my Rails logs (accompanied by a 500 error in the browser when it happens):

Started GET "/admin/pages" for <xxx.xxx.xxx.xxx> at 2012-02-02 01:52:03 -0500
Processing by PagesController#index as HTML
Completed 500 Internal Server Error in 4ms

ActiveRecord::StatementInvalid (PGError: SSL error: decryption failed or bad 
record mac
: SELECT "pages".* FROM "pages" ):
  app/controllers/pages_controller.rb:36:in `index'

What the hell?

Answer 1

If the database is running on localhost only, turn SSL off: it’s not really useful to encrypt a local connection. Either set ssl=false in postgresql.conf (and restart the db server) or tell your client not to use SSL while connecting. Some installations configure PostgreSQL to use SSL by default.