I am puzzled a bit about Postgres option sslmode=prefer. It implies that it negotiates with the server to figure out whether the server supports TLS or not.

I am curious how it's done. Does it try TLS first and if it fails, try without TLS or am I missing something in TLS (or Postgres) which allow them to truly negotiate this?

CodePudding user response：

Does it try TLS first and if it fails, try without TLS

Yes. And when both attempts fail, this might be visible, as two different error messages might be produced.