1.17.0 — PostgreSQL sslmode follows libpq

PostgreSQL TLS release: sslmode now follows libpq, so managed databases with a private CA (RDS/Aurora, Cloud SQL, Azure) connect under the default mode again. Highlights:

Fixed

• PostgreSQL sslmode now follows libpq. Every mode except disable verified the server certificate against the OS trust store, so prefer (the default, and the mode most URLs inherit without saying so) could not reach a managed database at all: RDS/Aurora, Cloud SQL and Azure present a certificate signed by their own private CA, and the handshake failed with UnknownIssuer before the first query. As in libpq (and therefore asyncpg and psycopg), prefer and require now encrypt without authenticating the server. The connection is still TLS; this is not a fallback to plaintext.

Added

• sslmode=verify-ca and sslmode=verify-full are accepted in PostgreSQL URLs and are the way to ask for certificate verification now that require no longer implies it. verify-ca checks the chain, verify-full also checks the hostname.
• sslrootcert=<path> adds the PEM roots in that file to the trust store for the verifying modes (typically the RDS/Cloud SQL CA bundle). As in libpq, it does not by itself turn verification on. An unreadable file, or one holding no certificate, is a configuration error rather than a silent fallback to the OS roots.

Full details in CHANGELOG.md.