SQLAlchemy ↔ PostgreSQL SSL Mode: What Exception Is Raised When Verification Fails?

When an application uses SQLAlchemy to connect to a PostgreSQL database via psycopg2, the sslmode parameter controls TLS certificate validation. Setting sslmode='verify-full' should cause the driver to reject connections whose server certificate cannot be verified against the supplied CA bundle.

The goal is to determine how SQLAlchemy propagates any SSL errors back to the application. In practice, the exception type and message that surface depend on the underlying DBAPI, leading to inconsistent error handling across drivers.

Given that SQLAlchemy itself does not perform DNS resolution or certificate validation—delegating both to psycopg2—there is uncertainty around the exact exception hierarchy and how to standardize error handling in a multi-driver environment.

Key unresolved questions:

• Which exception class does SQLAlchemy raise when sslmode='verify-full' fails due to an untrusted certificate?
• Does the error message include the underlying SSL error details, or is it abstracted by SQLAlchemy?
• Is there a documented approach to map these driver-specific exceptions into a unified error handling strategy across different DBAPI implementations?