fix: verify-ca requires an explicit ssl_ca file

CHANGELOG.md

@@ -85,6 +85,15 @@
   before this fix, and now connects successfully; confirmed no regression
   in `verify-ca`/`verify-full` (still correctly validate) or `require`
   against a non-SSL server (still correctly fails, per the previous entry).
+- `verify-ca` without an explicit `ssl_ca` file silently fell through to
+  `with_platform_verifier()` — full OS-trust-store validation — instead of
+  erroring, unlike the builtin driver's `build_postgres_tls_connector`,
+  which requires an explicit CA file for this mode (platform roots aren't
+  used, since macOS's strict EKU check rejects them) and errors clearly
+  otherwise. `build_tls_connector` now returns the same class of error when
+  `verify-ca` is set with no `ssl_ca`; `verify-full` without `ssl_ca`
+  continues to use the platform verifier unchanged, since that's the
+  documented distinction between the two modes.
 
 ## [1.0.0-beta.7] - 2026-08-17
 

src/client.rs

@@ -471,6 +471,15 @@ fn build_tls_connector(params: &ConnectionParams) -> Result<rustls::ClientConfig
         (None, None) => None,
     };
 
+    if params.ssl_mode.as_deref() == Some("verify-ca") && user_ca.is_none() {
+        return Err(
+            "verify-ca mode requires an explicit CA file via ssl_ca. Platform \
+             root certificates are not used for this mode — for automatic \
+             platform trust, use verify-full instead."
+                .to_string(),
+        );
+    }
+
     let needs_cert_validation = matches!(
         params.ssl_mode.as_deref(),
         Some("verify-ca" | "verify-full")

src/client_tests.rs

@@ -670,3 +670,20 @@ fn build_tls_connector_require_builds_successfully_with_no_ssl_ca() {
     build_tls_connector(&params)
         .expect("require mode must build a connector without needing ssl_ca set");
 }
+
+// Coverage for #46: verify-ca without an explicit ssl_ca silently fell
+// through to with_platform_verifier() instead of erroring — the builtin
+// driver's build_postgres_tls_connector errors instead ("verify-ca mode
+// requires an explicit CA file..."), since platform roots are deliberately
+// not used for this mode (macOS EKU checks reject them).
+#[test]
+fn build_tls_connector_verify_ca_without_ssl_ca_returns_a_clear_error() {
+    let params = params_with_ssl("verify-ca");
+
+    let err = build_tls_connector(&params)
+        .expect_err("verify-ca without ssl_ca must be rejected as a config error");
+    assert!(
+        err.contains("verify-ca") && err.contains("ssl_ca"),
+        "unexpected error message: {err}"
+    );
+}