<p dir="auto">Compiling the following with <code class="notranslate">deno compile -A</code></p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="const serve = await import(&quot;https://deno.land/std@0.139.0/http/server.ts&quot;)"><pre class="notranslate"><code class="notranslate">const serve = await import("https://deno.land/std@0.139.0/http/server.ts")
</code></pre></div>
<p dir="auto">Produces the following error:</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="error: Uncaught (in promise) TypeError: Module not found
const serve = await import(&quot;https://deno.land/std@0.139.0/http/server.ts&quot;);
              ^
    at async file:///home/user/deno-test/require.ts:1:15"><pre class="notranslate"><code class="notranslate">error: Uncaught (in promise) TypeError: Module not found
const serve = await import("https://deno.land/std@0.139.0/http/server.ts");
              ^
    at async file:///home/user/deno-test/require.ts:1:15
</code></pre></div>
<p dir="auto">This is using deno 1.21.3</p>
<p dir="auto"><code class="notranslate">ec2-52-54-1-79.compute-1.amazonaws.com:5432</code> is a PostgreSQL server with a self-signed SSL certificate (Heroku Postgres):</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="$ openssl s_client -starttls postgres -connect ec2-52-54-1-79.compute-1.amazonaws.com:5432 -verifyCAfile /tmp/cert -verify_hostname ip-10-0-81-231.ec2.internal &lt;/dev/null
CONNECTED(00000004)
depth=0 CN = ip-10-0-81-231.ec2.internal
verify return:1
---
Certificate chain
 0 s:CN = ip-10-0-81-231.ec2.internal
   i:CN = ip-10-0-81-231.ec2.internal
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIC3DCCAcSgAwIBAgIJAPvPvOOARSuaMA0GCSqGSIb3DQEBCwUAMCYxJDAiBgNV
BAMMG2lwLTEwLTAtODEtMjMxLmVjMi5pbnRlcm5hbDAeFw0yMDAzMDIxMDEzMTNa
Fw0zMDAyMjgxMDEzMTNaMCYxJDAiBgNVBAMMG2lwLTEwLTAtODEtMjMxLmVjMi5p
bnRlcm5hbDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAOHR949mb6Te
0/tr2057YWURGs85/6BRvBu+eC7mu/Ou0w9Z4xYMz8GCIbaqw+tHqM5LL7oc+jgm
3VbgZVk1JHoiDi+Bb4zOzHqAXn8GPZlX03pNVtXeOvzKUO+MGZ5ePimOf+ljgGkb
/N4FjYYW3v+tXVk1i2v02/jo5vjEPUaMLApTEDlfoWJyIyUvlc46Qecb5iQ5QzxZ
m4XEgAG52aTNT8Vvs906mW7sCqJ6TYQGyMUs5NvEbeG/+naGTa0VDWtfogDfeXWY
yN/sLY0YpE+lGjVSAizZAnv7/JgBCpMwTOVXiaZigoxByAiC2KzqkW/IIZIdhTOJ
1B/PqNJrkvcCAwEAAaMNMAswCQYDVR0TBAIwADANBgkqhkiG9w0BAQsFAAOCAQEA
BmS5whv6ImetznFEszGGm47lN69J0Bme91nKaMSRWYf4oF6DywHT9onCASdo9VKI
3Wfh3XGUu0W1RRHvLSn8hrpBe5qZnNj5iIkUSWWNjX5bg5/R1C8PaUXofx0CaPVw
NEgoWADy06+sotHDutEPaOsjFhSrIg3zX8LpsoOJmxwkGbiCAlNyEcQoJgpiUTte
QvWubGR6/M3Djl9Dgmnd1sHOEkaT1YUA0Cq8VpFNpQV6eEBpxn38aeeKtx7zblwr
UlN0CHc70vkD5hoyCTD7C5Tq+zY2fk4r9eWaHFcRWYSRPY6y6J9vEnkPwj7biQQD
1YZo1a+aKNkgwYfwETJ9fA==
-----END CERTIFICATE-----
subject=CN = ip-10-0-81-231.ec2.internal

issuer=CN = ip-10-0-81-231.ec2.internal

---
No client certificate CA names sent
Peer signing digest: SHA512
Peer signature type: RSA
Server Temp Key: ECDH, P-256, 256 bits
---
SSL handshake has read 1212 bytes and written 464 bytes
Verification: OK
Verified peername: ip-10-0-81-231.ec2.internal
---
New, TLSv1.2, Cipher is ECDHE-RSA-AES256-GCM-SHA384
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : ECDHE-RSA-AES256-GCM-SHA384
    Session-ID: 
    Session-ID-ctx: 
    Master-Key: 2540E33B75927E0AA4D9C9540B6F9A4FA965E604732675A5E3625631883EC323539B8200F2CCC9F5126938BEAB888517
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    Start Time: 1590879435
    Timeout   : 7200 (sec)
    Verify return code: 0 (ok)
    Extended master secret: no
---
DONE"><pre class="notranslate"><code class="notranslate">$ openssl s_client -starttls postgres -connect ec2-52-54-1-79.compute-1.amazonaws.com:5432 -verifyCAfile /tmp/cert -verify_hostname ip-10-0-81-231.ec2.internal &lt;/dev/null
CONNECTED(00000004)
depth=0 CN = ip-10-0-81-231.ec2.internal
verify return:1
---
Certificate chain
 0 s:CN = ip-10-0-81-231.ec2.internal
   i:CN = ip-10-0-81-231.ec2.internal
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIC3DCCAcSgAwIBAgIJAPvPvOOARSuaMA0GCSqGSIb3DQEBCwUAMCYxJDAiBgNV
BAMMG2lwLTEwLTAtODEtMjMxLmVjMi5pbnRlcm5hbDAeFw0yMDAzMDIxMDEzMTNa
Fw0zMDAyMjgxMDEzMTNaMCYxJDAiBgNVBAMMG2lwLTEwLTAtODEtMjMxLmVjMi5p
bnRlcm5hbDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAOHR949mb6Te
0/tr2057YWURGs85/6BRvBu+eC7mu/Ou0w9Z4xYMz8GCIbaqw+tHqM5LL7oc+jgm
3VbgZVk1JHoiDi+Bb4zOzHqAXn8GPZlX03pNVtXeOvzKUO+MGZ5ePimOf+ljgGkb
/N4FjYYW3v+tXVk1i2v02/jo5vjEPUaMLApTEDlfoWJyIyUvlc46Qecb5iQ5QzxZ
m4XEgAG52aTNT8Vvs906mW7sCqJ6TYQGyMUs5NvEbeG/+naGTa0VDWtfogDfeXWY
yN/sLY0YpE+lGjVSAizZAnv7/JgBCpMwTOVXiaZigoxByAiC2KzqkW/IIZIdhTOJ
1B/PqNJrkvcCAwEAAaMNMAswCQYDVR0TBAIwADANBgkqhkiG9w0BAQsFAAOCAQEA
BmS5whv6ImetznFEszGGm47lN69J0Bme91nKaMSRWYf4oF6DywHT9onCASdo9VKI
3Wfh3XGUu0W1RRHvLSn8hrpBe5qZnNj5iIkUSWWNjX5bg5/R1C8PaUXofx0CaPVw
NEgoWADy06+sotHDutEPaOsjFhSrIg3zX8LpsoOJmxwkGbiCAlNyEcQoJgpiUTte
QvWubGR6/M3Djl9Dgmnd1sHOEkaT1YUA0Cq8VpFNpQV6eEBpxn38aeeKtx7zblwr
UlN0CHc70vkD5hoyCTD7C5Tq+zY2fk4r9eWaHFcRWYSRPY6y6J9vEnkPwj7biQQD
1YZo1a+aKNkgwYfwETJ9fA==
-----END CERTIFICATE-----
subject=CN = ip-10-0-81-231.ec2.internal

issuer=CN = ip-10-0-81-231.ec2.internal

---
No client certificate CA names sent
Peer signing digest: SHA512
Peer signature type: RSA
Server Temp Key: ECDH, P-256, 256 bits
---
SSL handshake has read 1212 bytes and written 464 bytes
Verification: OK
Verified peername: ip-10-0-81-231.ec2.internal
---
New, TLSv1.2, Cipher is ECDHE-RSA-AES256-GCM-SHA384
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : ECDHE-RSA-AES256-GCM-SHA384
    Session-ID: 
    Session-ID-ctx: 
    Master-Key: 2540E33B75927E0AA4D9C9540B6F9A4FA965E604732675A5E3625631883EC323539B8200F2CCC9F5126938BEAB888517
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    Start Time: 1590879435
    Timeout   : 7200 (sec)
    Verify return code: 0 (ok)
    Extended master secret: no
---
DONE
</code></pre></div>
<p dir="auto">I have saved the server cert reported above into <code class="notranslate">/tmp/cert</code>.</p>
<p dir="auto">The following code fails:</p>
<div class="highlight highlight-source-ts notranslate position-relative overflow-auto" dir="auto" data-snippet-clipboard-copy-content="import { connectPg } from './src/mod.ts'
import { assertEquals } from 'https://deno.land/std/testing/asserts.ts'

const conn = await Deno.connect({
    hostname: 'ec2-52-54-1-79.compute-1.amazonaws.com',
    port: 5432,
})

// Write magic number
const magic = new Uint8Array(8);
(new DataView(magic.buffer)).setInt32(0, 8);
(new DataView(magic.buffer)).setInt32(4, 80877103);
assertEquals(await conn.write(magic), 8);

// Server should reply with 'S'
const reply = new Uint8Array(1)
assertEquals(await conn.read(reply), 1)
assertEquals(String.fromCharCode(reply[0]), 'S')

const tlsConn = await Deno.startTls(conn, {
    hostname: 'ip-10-0-81-231.ec2.internal',
    certFile: '/tmp/cert',
})

console.log('connected')"><pre class="notranslate"><span class="pl-k">import</span> <span class="pl-kos">{</span> <span class="pl-s1">connectPg</span> <span class="pl-kos">}</span> <span class="pl-k">from</span> <span class="pl-s">'./src/mod.ts'</span>
<span class="pl-k">import</span> <span class="pl-kos">{</span> <span class="pl-s1">assertEquals</span> <span class="pl-kos">}</span> <span class="pl-k">from</span> <span class="pl-s">'https://deno.land/std/testing/asserts.ts'</span>

<span class="pl-k">const</span> <span class="pl-s1">conn</span> <span class="pl-c1">=</span> <span class="pl-k">await</span> <span class="pl-smi">Deno</span><span class="pl-kos">.</span><span class="pl-en">connect</span><span class="pl-kos">(</span><span class="pl-kos">{</span>
    <span class="pl-c1">hostname</span>: <span class="pl-s">'ec2-52-54-1-79.compute-1.amazonaws.com'</span><span class="pl-kos">,</span>
    <span class="pl-c1">port</span>: <span class="pl-c1">5432</span><span class="pl-kos">,</span>
<span class="pl-kos">}</span><span class="pl-kos">)</span>

<span class="pl-c">// Write magic number</span>
<span class="pl-k">const</span> <span class="pl-s1">magic</span> <span class="pl-c1">=</span> <span class="pl-k">new</span> <span class="pl-smi">Uint8Array</span><span class="pl-kos">(</span><span class="pl-c1">8</span><span class="pl-kos">)</span><span class="pl-kos">;</span>
<span class="pl-kos">(</span><span class="pl-k">new</span> <span class="pl-smi">DataView</span><span class="pl-kos">(</span><span class="pl-s1">magic</span><span class="pl-kos">.</span><span class="pl-c1">buffer</span><span class="pl-kos">)</span><span class="pl-kos">)</span><span class="pl-kos">.</span><span class="pl-en">setInt32</span><span class="pl-kos">(</span><span class="pl-c1">0</span><span class="pl-kos">,</span> <span class="pl-c1">8</span><span class="pl-kos">)</span><span class="pl-kos">;</span>
<span class="pl-kos">(</span><span class="pl-k">new</span> <span class="pl-smi">DataView</span><span class="pl-kos">(</span><span class="pl-s1">magic</span><span class="pl-kos">.</span><span class="pl-c1">buffer</span><span class="pl-kos">)</span><span class="pl-kos">)</span><span class="pl-kos">.</span><span class="pl-en">setInt32</span><span class="pl-kos">(</span><span class="pl-c1">4</span><span class="pl-kos">,</span> <span class="pl-c1">80877103</span><span class="pl-kos">)</span><span class="pl-kos">;</span>
<span class="pl-en">assertEquals</span><span class="pl-kos">(</span><span class="pl-k">await</span> <span class="pl-s1">conn</span><span class="pl-kos">.</span><span class="pl-en">write</span><span class="pl-kos">(</span><span class="pl-s1">magic</span><span class="pl-kos">)</span><span class="pl-kos">,</span> <span class="pl-c1">8</span><span class="pl-kos">)</span><span class="pl-kos">;</span>

<span class="pl-c">// Server should reply with 'S'</span>
<span class="pl-k">const</span> <span class="pl-s1">reply</span> <span class="pl-c1">=</span> <span class="pl-k">new</span> <span class="pl-smi">Uint8Array</span><span class="pl-kos">(</span><span class="pl-c1">1</span><span class="pl-kos">)</span>
<span class="pl-en">assertEquals</span><span class="pl-kos">(</span><span class="pl-k">await</span> <span class="pl-s1">conn</span><span class="pl-kos">.</span><span class="pl-en">read</span><span class="pl-kos">(</span><span class="pl-s1">reply</span><span class="pl-kos">)</span><span class="pl-kos">,</span> <span class="pl-c1">1</span><span class="pl-kos">)</span>
<span class="pl-en">assertEquals</span><span class="pl-kos">(</span><span class="pl-smi">String</span><span class="pl-kos">.</span><span class="pl-en">fromCharCode</span><span class="pl-kos">(</span><span class="pl-s1">reply</span><span class="pl-kos">[</span><span class="pl-c1">0</span><span class="pl-kos">]</span><span class="pl-kos">)</span><span class="pl-kos">,</span> <span class="pl-s">'S'</span><span class="pl-kos">)</span>

<span class="pl-k">const</span> <span class="pl-s1">tlsConn</span> <span class="pl-c1">=</span> <span class="pl-k">await</span> <span class="pl-smi">Deno</span><span class="pl-kos">.</span><span class="pl-en">startTls</span><span class="pl-kos">(</span><span class="pl-s1">conn</span><span class="pl-kos">,</span> <span class="pl-kos">{</span>
    <span class="pl-c1">hostname</span>: <span class="pl-s">'ip-10-0-81-231.ec2.internal'</span><span class="pl-kos">,</span>
    <span class="pl-c1">certFile</span>: <span class="pl-s">'/tmp/cert'</span><span class="pl-kos">,</span>
<span class="pl-kos">}</span><span class="pl-kos">)</span>

<span class="pl-smi">console</span><span class="pl-kos">.</span><span class="pl-en">log</span><span class="pl-kos">(</span><span class="pl-s">'connected'</span><span class="pl-kos">)</span></pre></div>
<p dir="auto">result:</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="% deno run -A --unstable test.ts
Compile file:///Users/jaka/Development/pgc4d/test.ts
WARN RS - rustls::session:718 - Sending fatal alert BadCertificate
error: Uncaught InvalidData: invalid certificate: CertNotValidForName
    at unwrapResponse ($deno$/ops/dispatch_json.ts:43:11)
    at Object.sendAsync ($deno$/ops/dispatch_json.ts:98:10)
    at async Object.startTls ($deno$/tls.ts:70:15)
    at async file:///Users/jaka/Development/pgc4d/test.ts:24:17"><pre class="notranslate"><code class="notranslate">% deno run -A --unstable test.ts
Compile file:///Users/jaka/Development/pgc4d/test.ts
WARN RS - rustls::session:718 - Sending fatal alert BadCertificate
error: Uncaught InvalidData: invalid certificate: CertNotValidForName
    at unwrapResponse ($deno$/ops/dispatch_json.ts:43:11)
    at Object.sendAsync ($deno$/ops/dispatch_json.ts:98:10)
    at async Object.startTls ($deno$/tls.ts:70:15)
    at async file:///Users/jaka/Development/pgc4d/test.ts:24:17
</code></pre></div>
<p dir="auto">I believe this should work. As you can see, the <code class="notranslate">openssl s_client</code> says:</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="Verification: OK
Verified peername: ip-10-0-81-231.ec2.internal"><pre class="notranslate"><code class="notranslate">Verification: OK
Verified peername: ip-10-0-81-231.ec2.internal
</code></pre></div>