From 3c8b1d4b8ca24bcfc33ec47d344e106170a74f60 Mon Sep 17 00:00:00 2001
From: Francis Dupont <fdupont@isc.org>
Date: Wed, 9 Jul 2025 15:57:32 +0200
Subject: [PATCH] [#3927] Updated pgsql ssslmode code

---
 src/lib/pgsql/pgsql_connection.cc | 20 +++++++++-----------
 1 file changed, 9 insertions(+), 11 deletions(-)

diff --git a/src/lib/pgsql/pgsql_connection.cc b/src/lib/pgsql/pgsql_connection.cc
index 7cb17dac0f..65284f12c3 100644
--- a/src/lib/pgsql/pgsql_connection.cc
+++ b/src/lib/pgsql/pgsql_connection.cc
@@ -411,9 +411,9 @@ PgSqlConnection::getConnParametersInternal(bool logging) {
 
     bool tls = false;
 
-    string sslmode;
+    string ssslmode;
     try {
-        sslmode = getParameter("ssl-mode");
+        ssslmode = getParameter("ssl-mode");
         tls = true;
     } catch (...) {
         // No strict ssl mode
@@ -423,8 +423,8 @@ PgSqlConnection::getConnParametersInternal(bool logging) {
     try {
         sca = getParameter("trust-anchor");
         tls = true;
-        if (sslmode.empty()) {
-            sslmode = "verify-ca";
+        if (ssslmode.empty()) {
+            ssslmode = "verify-ca";
         }
         dbconnparameters += " sslrootcert = " + sca;
     } catch (...) {
@@ -450,17 +450,15 @@ PgSqlConnection::getConnParametersInternal(bool logging) {
     }
 
     if (tls) {
-        if (sslmode.empty()) {
-            sslmode = "require";
+        if (ssslmode.empty()) {
+            ssslmode = "require";
         }
         dbconnparameters += " gssencmode = disable";
-    } else {
-        if (sslmode.empty()) {
-            sslmode = "prefer";
-        }
     }
 
-    dbconnparameters += " sslmode = " + sslmode;
+    if (!ssslmode.empty()) {
+        dbconnparameters += " sslmode = " + ssslmode;
+    }
 
     return (dbconnparameters);
 }
-- 
2.47.2