An "SSL connection refused" error is a specific Transport Layer Security (TLS) handshake failure. In a CyberArk Conjur environment, this error commonly occurs when the client attempts to connect to a Follower whose hostname is not included in the Subject Alternative Name (SAN) field of the server certificate. The client's TLS library cannot validate the identity of the server it is connecting to, as the name in the URL does not match any of the names the certificate is valid for. The correct and secure resolution is to generate a new certificate that includes the DNS names of the Master, all Standbys, and all Followers in the SAN list, and then redeploy it across the cluster.

B. PostgreSQL ports (5432, 1999) are used for database replication between the Master and Followers, not for client-facing REST API traffic, which occurs over HTTPS.

C. A blocked port 443 would typically cause a TCP-level "connection timed out" or generic "connection refused" error, preventing the TLS handshake from even starting.

D. Suppressing SSL certificate checking is a significant security vulnerability. It circumvents the problem rather than solving it and should never be used in a production environment.

1. CyberArk Conjur Enterprise Documentation

"Deploy a Conjur Cluster": In the "Before you begin" section for deploying a cluster

the documentation explicitly states a key prerequisite: "A server certificate/key pair for the Conjur Leader

Standbys

and Followers. The certificate must include the DNS names and/or IP addresses of all the nodes in the cluster in the Subject Alternative Name (SAN) extension." This directly supports the reasoning that a missing SAN for the Follower will cause connection issues.

2. CyberArk Conjur Enterprise Documentation

"Troubleshooting": The troubleshooting guide for installation often lists certificate misconfiguration as a primary cause for connectivity problems. Specifically

it notes that for SSL/TLS to work correctly

"the FQDN of every node in your HA cluster (Leader

Standbys

and Followers) must be included in the certificate's Subject Alternative Name (SAN) list." This confirms that the absence of the Follower's hostname is the root cause of the SSL error.