PostgreSQL 16.4配置后量子密码学(PQC)自签名证书时SSL连接出现EOF错误的排查求助

我正在给PostgreSQL 16.4配置基于后量子密码学（PQC）的自签名证书，目标是用Kyber768作为KEM密钥交换算法、Dilithium3作为数字签名算法，但在尝试连接时遇到了SSL握手失败的问题，日志里报EOF错误，实在搞不定，来求助大家！

错误日志信息 #

服务端日志：

LOG:  08P01: could not accept SSL connection: EOF detected
2024-11-06 09:26:26.822 AEDT [80760] LOCATION:  be_tls_open_server, be-secure-openssl.c:523

客户端连接命令及错误：

(base) mandapatisaigautam@Mandapatis-iMac postgresql_certs % psql "sslmode=verify-full sslrootcert=/Users/mandapatisaigautam/postgresql_certs/dilithium3_CA_2.crt sslcert=/Users/mandapatisaigautam/postgresql_certs/new_pqc_client_2.crt sslkey=/Users/mandapatisaigautam/postgresql_certs/new_pqc_client_2.key dbname=postgres host=localhost"
Successfully set KEX/KEM group to: kyber768
psql: error: connection to server at "localhost" (127.0.0.1), port 5432 failed: SSL error: no SSL error reported

我的环境与前期准备 #

• 使用OpenSSL 3.3.2版本，已经在openssl.conf中启用了PQC算法支持
• 按照PQC要求生成了服务端和客户端的自签名证书，并完成了对应配置

PostgreSQL服务端配置（postgresql.conf） #

listen_addresses = '*'  

# - SSL -

ssl = on
ssl_ca_file = '/Users/mandapatisaigautam/postgresql_certs/dilithium3_CA_2.crt'
ssl_cert_file = '/Users/mandapatisaigautam/postgresql_certs/server_pqc_2.crt'
#ssl_crl_file = ''
#ssl_crl_dir = ''
ssl_key_file = '/Users/mandapatisaigautam/postgresql_certs/server_pqc_2.key'
ssl_ciphers = 'HIGH:!aNULL' # allowed SSL ciphers
ssl_prefer_server_ciphers = on
#ssl_ecdh_curve = 'prime256v1'
ssl_min_protocol_version = 'TLSv1.2'
ssl_max_protocol_version = 'TLSv1.3'
#ssl_dh_params_file = ''
#ssl_passphrase_command = ''
#ssl_passphrase_command_supports_reload = off

我对PostgreSQL源码的修改 #

为了启用Kyber768作为KEM算法，我修改了以下两个文件：

客户端：fe-secure-openssl.c #

添加了设置KEM组的代码：

if (!SSL_CTX_set1_groups_list(SSL_context, "kyber768") !=1 ) {
        fprintf(stderr, "Failed to set KEX/KEM group: kyber768\n");
        SSL_CTX_free(SSL_context);
        return -1;
    }
    fprintf(stdout, "Successfully set KEX/KEM group to: kyber768\n");

    return 0;

服务端：be-secure-openssl.c #

新增了initialize_kem函数，并且注释掉了原有的initialize_ecdh函数：

static bool
initialize_kem(SSL_CTX *context, bool isServerStart)
{
#ifndef OPENSSL_NO_KEM

   
    if (SSL_CTX_set1_groups_list(context, "kyber768") != 1)
    {
        ereport(isServerStart ? FATAL : LOG,
                (errcode(ERRCODE_CONFIG_FILE_ERROR),
                 errmsg("KEX: could not set key exchange algorithms with specified KEM groups")));
        return false;
    }

    ereport(LOG, (errmsg("KEX: successfully set key exchange algorithms with specified KEM groups")));
#endif

    return true;
}

预期与问题 #

我原本以为这些配置和代码修改能让PostgreSQL成功使用PQC证书和Kyber768完成SSL连接，但现在连接时出现了EOF错误。想请教大家：

• 这个EOF错误可能是什么原因导致的？
• 我还可以采取哪些排查或解决步骤来修复这个问题？

备注：内容来源于stack exchange，提问作者Sai Gautam Mandapati