Getting "Error: self-signed certificate in certificate chain"

[oliwerhelsen]

Hi Guys,

I guess that I need to add my Certificate, but where? Is it under Database_extra? If yes, how is the structure, can't see it in the type.

Thankful for the support 🙏

Best regards!

[SGFGOV]

Which dB provider are you using?

…

On Fri, 26 May, 2023, 00:50 Oliwer Helsén, ***@***.***> wrote: Hi Guys, I guess that I need to add my Certificate, but where? Is it under Database_extra? If yes, how is the structure, can't see it in the type. Thankful for the support 🙏 Best regards! — Reply to this email directly, view it on GitHub <#4181>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AXEQJHC6QMBIJUA6V5ANYVLXH6WJJANCNFSM6AAAAAAYPI3MRA> . You are receiving this because you are subscribed to this thread.Message ID: ***@***.***>

-- This message (including any attachments) may contain confidential, proprietary, privileged and/or private information. The information is intended to be for the use of the individual or entity designated above. If you are not the intended recipient of this message, please notify the sender immediately, and delete the message and any attachments. Any disclosure, reproduction, distribution or other use of this message or any attachments by an individual or entity other than the intended recipient is prohibited.   

[oliwerhelsen]

Postgres

[Alexnortung]

You need to specify database_extra with ssl in your projectConfig.

I had the same issue and solved it with the following part

const projectConfig = {
  // ...
  database_extra:
    process.env.DATABASE_SSL !== 'true'
      ? undefined
      : {
          ssl: {
            rejectUnauthorized: false,
          },
        },
};

Then just set DATABASE_SSL to true in your envirnoment variables

You can also see the docs for general deployment

[OlivierCoq]

I'm getting the same error, but this solution did not work for me. I'm following the Digital Ocean deployment docs line by line, but still running into this.

[SamuelMabonga]

Same Issue on my end

[Saba-Shavidze]

Is there any update? I'm getting the same kind of error, while trying to connect rds [email protected] instance, I've downloaded the relevant certificates from aws, trying to apply them on server side:

const database_extra =  process.env.DATABASE_SSL ? {
  ssl: {
    rejectUnauthorized: true,
    ca: process.env.DATABASE_SSL_CA,
  }
}: {}
  database_extra: database_extra,

Getting "Error: self-signed certificate in certificate chain"

Can someone help me?

[rodrigouz]

The error "self-signed certificate in certificate chain" typically occurs when your client (in this case, your application or the tool you're using to connect to the Postgres instance) is rejecting the SSL certificate provided by the Postgres server.

This worked for me:

1. Get CA Certificate from the database provider in this case Digital Ocean.
2. Tested using psql to connect to the Postgres instance, you can specify the location of the certificate file using the sslrootcert parameter:

psql "postgresql://username:password@hostname:port/databasename?sslmode=require&sslrootcert=/path/to/certificate.crt"

[carlosxmerca]

Hi, I also experienced the "self-signed certificate in certificate chain" error when trying to connect to a public RDS postgres instance, RDS forces connections to be encrypted, but it is also necessary to use a certificate that can be downloaded at least in the case of AWS from certificates

database_extra:
  process.env.POSTGRES_SSL === "ssl"
    ? {
        ssl: {
          rejectUnauthorized: true,
          ca: fs.readFileSync(process.env.POSTGRES_CA).toString(),
        },
      }
    : undefined,

The configuration I use is the following, very similar to what @Saba-Shavidze had proposed, where POSTGRES_CA is the relative or absolute path to the .pem file with the certificate, I also keep my URL like this: postgres://<user>:<password>@<host>:<port>/<database> without including the sslmode or ssl queries, the RDS service automatically establishes the encrypted connection when it detects the certificate, for some reason when the query exists the settings sent in database_extra are ignored or overwritten. You can find more information about a similar situation in this issue

Hope it helps 😄

[demandre]

without including the sslmode or ssl queries

This is what i was missing ! Thanks a lot 😁