PostgreSQL "no pg_hba.conf entry for host" — Rule Exists, Why Rejected?
Diagnosing pg_hba.conf rejection: understanding first-match rule evaluation, inspecting pg_hba_file_rules, host vs hostssl TLS mismatches, and pg_reload_conf.
Operational Verification & Reliability Metadata
The error string is a symptom, not the root cause. Do not restart the server blindly. Run the diagnostic queries below to pinpoint the actual failure mode.
▸Symptom
FATAL: no pg_hba.conf entry for host "10.0.2.15", user "app", database "app", no encryption
FATAL: no pg_hba.conf entry for host "10.0.2.15", user "app", database "app", SSL offSQLSTATE code: 28000 (invalid_authorization_specification).
The terminal snippet (SSL off, no encryption, or SSL on) identifies whether the connecting client negotiated TLS encryption.
Administrators frequently ask: *"I already appended the client IP to pg_hba.conf, why is it still getting rejected?"*
pg_hba.conf does not evaluate rules based on specificity (most specific CIDR mask does NOT take priority). PostgreSQL scans the configuration file sequentially from top to bottom and applies the very FIRST record that matches.
If a broad catch-all record exists higher up in the file (e.g. host all all 0.0.0.0/0 reject or an overly restrictive hostssl entry), any fine-grained rule placed below it is completely unreachable.▸Diagnostic Step: Querying `pg_hba_file_rules`
Rather than parsing configuration files manually on disk, inspect PostgreSQL's parsed rule evaluation table:
SELECT line_number, type, database, user_name, address, netmask,
auth_method, error
FROM pg_hba_file_rules
ORDER BY line_number;Benefits of inspecting pg_hba_file_rules:
- 1Reveals the exact sequential evaluation order evaluated by the postmaster.
- 2The `error` column flags syntax errors that cause PostgreSQL to silently bypass malformed lines.
- 3Confirm the actual configuration file path being consumed:
SHOW hba_file;
SHOW listen_addresses;
SHOW port;Editing the wrong pg_hba.conf across multiple cluster installations is a common mistake.
▸Disambiguating `host`, `hostssl`, and `hostnossl`
- •`host`: Matches both TLS-encrypted and unencrypted TCP connections.
- •`hostssl`: Matches only TLS/SSL connections. If the client connects with
sslmode=disable, this rule will not match, triggeringFATAL: no pg_hba.conf entry ... SSL off. - •`hostnossl`: Matches only unencrypted connections; secure clients will not match.
▸Step-by-Step Production Resolution
1. Place the Rule Early with Narrow Subnet Definitions
Insert a specific rule near the top of pg_hba.conf:
# TYPE DATABASE USER ADDRESS METHOD
hostssl app app 10.0.2.0/24 scram-sha-2562. Reload Configuration with Zero Downtime
Modifying pg_hba.conf never requires a cluster restart. To apply rules instantaneously without disconnecting active client sessions:
SELECT pg_reload_conf();Or via the operating system shell:
systemctl reload postgresql3. Confirm Network Binding in postgresql.conf
Ensure the daemon listens on network interfaces:
listen_addresses = '*'▸Related Error Guides & Hub Links
- •PostgreSQL Password Authentication Failed (H-02) — Authentication credential failures
- •PostgreSQL Connection Refused (H-07) — Port binding and firewall blocks
- •PostgreSQL Terminating Connection (H-31) — Session drops
- •PostgreSQL Hub — Network security and authentication architecture
Other Database Error Triage Playbooks
Other battle-tested diagnostic guides for high-severity database errors.
PostgreSQL Connection Exhaustion & too many clients Triage
Root causes of FATAL: sorry, too many clients already and remaining connection slots errors, read-only pg_stat_activity diagnosis with privilege boundaries, and two-tier pooling mitigation.
PostgreSQL password authentication failed: Root Cause and Fix
Four root causes of psql password authentication failed: incorrect password, md5/SCRAM mismatch, pg_hba.conf rule ordering, and port/cluster confusion. Step-by-step triage.
PostgreSQL connection refused: 8-Step Definitive Triage
Difference between connection refused, timeout, and no pg_hba entry; triage for listen_addresses, port conflicts, firewalls, and Docker container mappings.