# X_REPLICATION_TLS

## Means

the replication connection failed TLS

## Typical cause

the server certificate failed the verification the sslmode asks for (verify-ca: the chain; verify-full: the chain and the host name), sslrootcert names no readable file, or the TLS handshake itself failed

## Fix

`openssl s_client -starttls postgres -connect "$PGHOST:$PGPORT" -showcerts </dev/null` shows the chain and names the server presents; then pass its CA with `?sslrootcert=/path/to/ca.crt`, connect with a name the certificate lists, or use `?sslmode=require` to encrypt without verifying

[Realtime](/error-codes#realtime)