034-verify-full-skips-hostname-check-without-sni.patch

diff --git a/src/sql_jsc/postgres/PostgresSQLConnection.rs b/src/sql_jsc/postgres/PostgresSQLConnection.rs
index 7bbb6586b1..1ea24564a0 100644
--- a/src/sql_jsc/postgres/PostgresSQLConnection.rs
+++ b/src/sql_jsc/postgres/PostgresSQLConnection.rs
@@ -876,22 +876,24 @@ impl PostgresSQLConnection {
                             return;
                         }
 
-                        // SAFETY: native handle of a connected TLS socket is `SSL*`.
-                        let ssl_ptr: *mut BoringSSL::c::SSL = self
-                            .socket
-                            .get()
-                            .get_native_handle()
-                            .map_or(core::ptr::null_mut(), |p| p.cast());
-                        if let Some(servername) =
-                            unsafe { BoringSSL::c::SSL_get_servername(ssl_ptr, 0).as_ref() }
-                        {
-                            // SAFETY: SSL_get_servername returns a NUL-terminated C string.
-                            let hostname = unsafe {
-                                bun_core::ffi::cstr(
-                                    std::ptr::from_ref(servername).cast::<core::ffi::c_char>(),
-                                )
+                        if self.ssl_mode == SSLMode::VerifyFull {
+                            let servername = self.tls_config.server_name();
+                            if servername.is_null() {
+                                let Ok(v) = verify_error_to_js(&ssl_error, self.global()) else {
+                                    return;
+                                };
+                                self.fail_with_js_value(v);
+                                return;
                             }
-                            .to_bytes();
+
+                            // SAFETY: native handle of a connected TLS socket is `SSL*`.
+                            let ssl_ptr: *mut BoringSSL::c::SSL = self
+                                .socket
+                                .get()
+                                .get_native_handle()
+                                .map_or(core::ptr::null_mut(), |p| p.cast());
+                            // SAFETY: `servername` is a NUL-terminated C string owned by `tls_config`.
+                            let hostname = unsafe { bun_core::ffi::cstr(servername) }.to_bytes();
                             // SAFETY: `ssl_ptr` is the live SSL* of a connected TLS socket.
                             if !BoringSSL::check_server_identity(unsafe { &mut *ssl_ptr }, hostname)
                             {