Hello all. I'm hoping someone has some experience on this and could provide some assistance. I'm trying to install Ory Kratos on my Kubernetes cluster and I'm using Postgres which is managed by Postgres Operator. Postgres Operator only accepts connections over TLS and generates a self-signed cert and root CA to use for that purpose. However, it appears the SANs that it generates are invalid to Go's X509 parser. I get this error:

time=2025-12-12T11:31:42Z level=warning msg=Unable to ping database, retrying. audience=application error=map[message:failed to connect to `user=ory database=ory-kratos`: 10.21.69.228:5432 (postgres-primary.shared.svc.cluster.local.): failed to write startup message: write failed: tls: failed to parse certificate from server: x509: SAN dNSName is malformed] service_name=Ory Kratos service_version=v25.4.0

(Here, I am connecting with hostname =

postgres-primary.shared.svc.cluster.local.

, but I've also tried

postgres-primary.shared.svc

and

postgres-primary.shared

.) In the certificate, the SANs are:

X509v3 Subject Alternative Name: DNS:postgres-primary.shared.svc.cluster.local., DNS:postgres-primary.shared.svc, DNS:postgres-primary.shared, DNS:postgres-primary, DNS:postgres-replicas.shared.svc.cluster.local., DNS:postgres-replicas.shared.svc, DNS:postgres-replicas.shared, DNS:postgres-replicas

To be transparent, this has me baffled and I have consulted AI - it said that having a trailing dot in SANs is rejected in Go and my only solution other than disabling TLS (which I'm not sure I can do), is to generate custom certs without trailing dots in the SANs. Postgres Operator has a custom cert functionality, so I might be able to look into it. I've tried sslmode=require with sslrootcert="" (if sslrootcert is not empty, pgx switches to verify-ca), sslmode=verify-ca with the sslrootcert specified to the generated CA, sslmode=verify-full with and without sslrootcert specified, and sslmode=prefer. I'm now at a loss so my fate is in your hands if anyone would be so kind to offer me any advice I would eternally appreciate it.

configure postgres operator to issue a different cert?

Yeah seems like that's the move. =( Will try it.