Parameter · Developer Options
trace_connection_negotiation
Logs details of pre-authentication connection handshake.
- Default:
off - Type: bool
- Applies: Restart required
In plain words
Before a client logs in, it may ask the server to switch to an encrypted connection (SSL or GSSAPI). This setting logs whether each such request was accepted or rejected, which helps when a client cannot connect and you suspect the encryption handshake.
For DBAs and operators
Added in PostgreSQL 17, together with direct SSL negotiation (sslnegotiation=direct in libpq). It can only be set at server start. The messages are LOG level and come from the new backend before authentication:
An SSLRequest is rejected when ssl is off (the client then falls back to plain text if its sslmode allows). For full connection tracing, combine it with log_connections, which in PostgreSQL 18 can also log timings of the connection setup.
Developer option: meant for debugging and testing PostgreSQL itself. Leave it at the default on production servers unless a specific diagnosis calls for it.
How to change it
Change in postgresql.conf or ALTER SYSTEM, then restart the server.