Why does DBeaver fail to validate a PostgreSQL server's SSL certificate when the hostname resolves via DNS, and how can I configure a custom truststore to fix it?

When connecting to a PostgreSQL instance over TLS using DBeaver, the client sometimes rejects the server's certificate despite the certificate being valid and trusted by the system Java keystore. The issue appears to be related to DNS resolution of the host name used in the connection string, which may cause a mismatch between the certificate's subject alternative name and the address DBeaver uses during the TLS handshake. Adjusting the connection's network settings or providing an explicit truststore does not consistently resolve the problem.

What DNS-related settings in DBeaver influence how the host name is presented to the TLS layer, how can I verify that DBeaver is using the correct truststore for certificate validation, and are there any known limitations when using the built‑in SSL configuration UI with custom certificates for PostgreSQL connections?