libpq_system_ca_fix.diff

diff --git a/src/interfaces/libpq/fe-secure-openssl.c b/src/interfaces/libpq/fe-secure-openssl.c
index 00b203cbfa..732ae70a89 100644
--- a/src/interfaces/libpq/fe-secure-openssl.c
+++ b/src/interfaces/libpq/fe-secure-openssl.c
@@ -1508,8 +1508,18 @@ open_client_SSL(PGconn *conn)
 			case SSL_ERROR_SYSCALL:
 				{
 					char		sebuf[PG_STRERROR_R_BUFLEN];
-
-					if (r == -1)
+					unsigned long vcode = SSL_get_verify_result(conn->ssl);
+
+					/*
+					 * If we get an X509 error here without an error in the
+					 * socket layer it means that verification failed without
+					 * it being a protocol error. A common cause is trying to
+					 * a default system CA which is missing or broken.
+					 */
+					if (!errno && vcode != X509_V_OK)
+						libpq_append_conn_error(conn, "SSL error: certificate verify failed: %s",
+												X509_verify_cert_error_string(ecode));
+					else if (r == -1)
 						libpq_append_conn_error(conn, "SSL SYSCALL error: %s",
 										  SOCK_STRERROR(SOCK_ERRNO, sebuf, sizeof(sebuf)));
 					else