Change default sslmode from "require" to "prefer"

CHANGELOG.md

@@ -1,6 +1,10 @@
 unreleased
 ----------
 
+This release changes the default `sslmode` from `require` to `prefer`, which is
+the default used by libpq and the rest of the PostgreSQL ecosystem. See [#1271]
+for some background.
+
 ### Features
 
 - Support protocol 3.2, and the `min_protocol_version` and
@@ -15,6 +19,7 @@ unreleased
 [#1258]: https://github.com/lib/pq/pull/1258
 [#1265]: https://github.com/lib/pq/pull/1265
 [#1270]: https://github.com/lib/pq/pull/1270
+[#1271]: https://github.com/lib/pq/pull/1271
 
 v1.11.2 (2026-02-10)
 --------------------

connector.go

@@ -462,6 +462,7 @@ func newConfig(dsn string, env []string) (Config, error) {
 		Host:               "localhost",
 		Port:               5432,
 		SSLSNI:             true,
+		SSLMode:            SSLModePrefer,
 		MinProtocolVersion: "3.0",
 		MaxProtocolVersion: "3.0",
 	}
@@ -902,7 +903,7 @@ func (cfg Config) string() string {
 		switch k {
 		case "datestyle", "client_encoding":
 			continue
-		case "host", "port", "user", "sslsni", "min_protocol_version", "max_protocol_version":
+		case "host", "port", "user", "sslsni", "sslmode", "min_protocol_version", "max_protocol_version":
 			if !cfg.isset(k) {
 				continue
 			}

connector_test.go

@@ -350,14 +350,14 @@ func TestNewConfig(t *testing.T) {
 	}{
 		// Override defaults
 		{"", nil, "", ""},
-		{"user=u port=1 host=example.com", nil,
-			"host=example.com port=1 user=u", ""},
-		{"", []string{"PGUSER=u", "PGPORT=1", "PGHOST=example.com"},
-			"host=example.com port=1 user=u", ""},
+		{"user=u port=1 host=example.com sslmode=verify-ca", nil,
+			"host=example.com port=1 sslmode=verify-ca user=u", ""},
+		{"", []string{"PGUSER=u", "PGPORT=1", "PGHOST=example.com", "PGSSLMODE=verify-ca"},
+			"host=example.com port=1 sslmode=verify-ca user=u", ""},
 
 		// Socket
-		{"host=/var/run/psql", nil, "host=/var/run/psql sslmode=disable", ""},
-		{"host=@/var/run/psql", nil, "host=@/var/run/psql sslmode=disable", ""},
+		{"host=/var/run/psql", nil, "host=/var/run/psql", ""},
+		{"host=@/var/run/psql", nil, "host=@/var/run/psql", ""},
 		{"host=/var/run/psql sslmode=require", nil, "host=/var/run/psql sslmode=disable", ""},
 
 		// Empty value, value with space, and value with escaped \'

error_test.go

@@ -269,7 +269,7 @@ func TestRetryError(t *testing.T) {
 }
 
 func TestNetworkError(t *testing.T) {
-	c, err := NewConnector("")
+	c, err := NewConnector("sslmode=disable")
 	if err != nil {
 		t.Fatal(err)
 	}

internal/pqtest/pqtest.go

@@ -70,7 +70,6 @@ func DSN(conninfo string) string {
 		defaultTo("PGHOST", "localhost")
 		defaultTo("PGDATABASE", "pqgo")
 		defaultTo("PGUSER", "pqgo")
-		defaultTo("PGSSLMODE", "disable")
 		defaultTo("PGCONNECT_TIMEOUT", "20")
 	})
 

ssl.go

@@ -71,7 +71,7 @@ func ssl(cfg Config, mode SSLMode) (func(net.Conn) (net.Conn, error), error) {
 	case mode == SSLModeDisable || mode == SSLModeAllow:
 		return nil, nil
 
-	case mode == "" || mode == SSLModeRequire || mode == SSLModePrefer:
+	case mode == SSLModeRequire || mode == SSLModePrefer:
 		// We must skip TLS's own verification since it requires full
 		// verification since Go 1.3.
 		tlsConf.InsecureSkipVerify = true

ssl_test.go

@@ -62,6 +62,10 @@ func TestSSLMode(t *testing.T) {
 		connect string
 		wantErr string
 	}{
+		// Default (prefer) should work both with and without ssl.
+		{"user=pqgossl", ""},
+		{f.DSN(), ""},
+
 		// sslmode=require: require SSL, but don't verify certificate.
 		{"sslmode=require user=pqgossl", ""},
 		{"sslmode=require " + f.DSN(), "pq: SSL is not enabled on the server"},