self signed certificate in certificate chain

Node.js version: 14.17.0 pg version: 8.6.0

other related packages:

        "pg-connection-string": "^2.5.0",
        "pg-pool": "^3.3.0",
        "pg-protocol": "^1.5.0",

code:

const options = {
  connectionString: 'postgres://username:password@host:port/dbname?sslmode=verify-full',
  connectionTimeoutMillis: 50000,
  query_timeout: 50000,
  ssl: {
    ca: <loaded from file>,
    rejectUnauthorized: false
  }
}

const client = new pg.Client(options)
try {
    await client.connect()
  } catch(err) {
    if (err) {
      console.error('failed to connect to pg client', err)
      process.exit(1)
    }
  }

output is as following:

failed to connect to pg client Error: self signed certificate in certificate chain
    at TLSSocket.onConnectSecure (_tls_wrap.js:1507:34)
    at TLSSocket.emit (events.js:376:20)
    at TLSSocket._finishInit (_tls_wrap.js:932:8)
    at TLSWrap.ssl.onhandshakedone (_tls_wrap.js:706:12) {
  code: 'SELF_SIGNED_CERT_IN_CHAIN'
}

workable with NODE_TLS_REJECT_UNAUTHORIZED=0, but it is not suggested to program security.

[charmander]

@NicholasIoanJones If all you need to specify is rejectUnauthorized: false, you can omit ssl from the configuration object and switch between sslmode=no-verify in production and no sslmode in development.

[lornajane]

I’m also running into this, using PostgreSQL as a service, and it includes a ?sslmode=require in its connection params, which means that my code always fails since I can’t pass in the cert.