# Issue: AWX cannot connect to Aurora PostgreSQL 17 due to SSL

**URL:** <https://forum.ansible.com/t/issue-awx-cannot-connect-to-aurora-postgresql-17-due-to-ssl/45327>\
**Category:** Get Help\
**Tags:** kubernetes, aws, awx, postgresql\
**Created:** [February 12, 2026, 9:24pm UTC](https://forum.ansible.com/t/issue-awx-cannot-connect-to-aurora-postgresql-17-due-to-ssl/45327 "2026-02-12T21:24:15Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Rushabh\_Patel](https://avatars.discourse-cdn.com/v4/letter/r/858c86/32.png) [@Rushabh\_Patel](https://forum.ansible.com/u/Rushabh_Patel)\
**Post date:** [February 12, 2026, 9:24pm UTC](https://forum.ansible.com/t/issue-awx-cannot-connect-to-aurora-postgresql-17-due-to-ssl/45327/1 "2026-02-12T21:24:15Z")

</div>

\*\*AWX cannot connect to Aurora PostgreSQL 17 \*\*.

**Environment**

AWX Operator Version: (add your version, e.g., 2.19.1)  
AWX Version: 3.2.0  
Kubernetes Version: v1.33  
PostgreSQL: AWS Aurora PostgreSQL v17  
Deployment: External DB (Aurora) + AWX on EKS

**Description of the Issue**

When deploying AWX with an external Aurora PostgreSQL 17 database on an EKS v1.33 cluster, AWX fails to establish a PostgreSQL connection.  
Aurora receives invalid SSL packets, and AWX logs report certificate verification errors. As a result, AWX containers enter a crash loop and never complete initialization.

**Steps to Reproduce**

- Deploy Aurora PostgreSQL Compatible Edition v17.
- Deploy AWX Operator with a custom AWX CR referencing the Aurora endpoint.
- Observe AWX pods.  
 ![image](https://us1.discourse-cdn.com/ansible/original/2X/1/1e52c8169cc99a5c44ee1a07490bf1c77e4bc3ad.png)

values.yaml

```auto
AWX:
  # enable use of awx-deploy template
  enabled: true
  name: awx
  spec:
    admin_user: admin

  # configurations for external postgres instance
  postgres:
    enabled: true
    host: cid-poc1-awx-rds-.cluster-.us-east-1.rds.amazonaws.com
    port: 5432
    dbName: awx
    username: ulKrPh2p8qrNBo4Q
    # for secret management, pass in the password independently of this file
    # at the command line, use --set AWX.postgres.password
    password: Unset
    sslmode: verify-full
    type: unmanaged

rbac:
  create: true

operator-controller: {}

operator-controller-containers: {}

```

Relevant Aurora DB Logs

```auto
2026-02-12 19:00:39 UTC:10.205.26.178(48258):[unknown]@[unknown]:[21050]:LOG:
could not accept SSL connection: BAD_PACKET_LENGTH

```

kubectl logs awx-web-7fcdbdf94f-w5q9h -n awx

 ![image](https://us1.discourse-cdn.com/ansible/original/2X/5/5bcf29e49dd1206fc085e634e81048517b0e01df.png)  
 ![image](https://us1.discourse-cdn.com/ansible/original/2X/f/f69f17d89f1e6978a128d06348c1518fe1113230.png)

Relevant AWX Pod Logs (awx-web)  
The AWX application repeatedly fails with certificate errors:

```auto
psycopg.OperationalError: connection failed: certificate verify failed
django.db.utils.OperationalError: connection failed: certificate verify failed

AWX web container eventually enters FATAL state:
WARN exited: awx-cache-clear (exit status 1; not expected)
...

```

gave up: awx-cache-clear entered FATAL state, too many start retries too quickly

---

<div class="post-metadata">

**Author:** ![vmoravec](https://avatars.discourse-cdn.com/v4/letter/v/e5b9ba/32.png) [@vmoravec](https://forum.ansible.com/u/vmoravec)\
**Post date:** [February 23, 2026, 11:17am UTC](https://forum.ansible.com/t/issue-awx-cannot-connect-to-aurora-postgresql-17-due-to-ssl/45327/2 "2026-02-23T11:17:27Z")

</div>

You need to configure and provide AWS certificates for creating the SSL connection to your database.  
Your kubernetes deployment manifest for AWX needs a reference to cert bundle secret, i.e. `bundle_cacert_secret: bundle-cacert-secret` . This secret has to contain the public certificates which AWS provides individually for every region. You can create it like this: `kubectl create secret generic bundle-cacert-secret --from-file=bundle-ca.crt=YOUR_PATH_TO_CERTS/rds-ca-cert-$AwsRegion-bundle.pem --namespace awx`

---

<div class="post-metadata">

**Author:** ![Rushabh\_Patel](https://avatars.discourse-cdn.com/v4/letter/r/858c86/32.png) [@Rushabh\_Patel](https://forum.ansible.com/u/Rushabh_Patel)\
**Post date:** [March 11, 2026, 2:20pm UTC](https://forum.ansible.com/t/issue-awx-cannot-connect-to-aurora-postgresql-17-due-to-ssl/45327/3 "2026-03-11T14:20:02Z")

</div>

Thank you for the reply, but i got the work around it was because of this “sslmode: verify-full” i need to change it to another mode.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/ansible/original/1X/1882d9a01da5d8996a862359b0913cc568a39b84.svg) [@system](https://forum.ansible.com/u/system)\
**Post date:** [April 10, 2026, 2:20pm UTC](https://forum.ansible.com/t/issue-awx-cannot-connect-to-aurora-postgresql-17-due-to-ssl/45327/4 "2026-04-10T14:20:18Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.