Can't connect to Managed Database ('SELF_SIGNED_CERT_IN_CHAIN' error)

@luizhrqas

Thanks for posting a question here, I tried to reproduce your error but I failed to do so, I just created a new fresh PostgreSQL cluster and used this code to connect to it without any problems:

const connectionString = 'postgresql://doadmin:xxxx@db-postgresql-nyc1-57414-do-user-1548131-0.db.ondigitalocean.com:25060/defaultdb?sslmode=require'

const { Pool } = require('pg')
const pool = new Pool({
  connectionString: connectionString,
  ssl: true
})

pool.connect()

If you use my code do you still get the same error?

Thanks a lot

You need to pass { rejectUnauthorized: false } as the ssl option.

I used the following script, but with sensitive values removed:

const { Sequelize } = require('sequelize');

const sequelize = new Sequelize({
  dialect: 'postgres',
  host: '',
  port: 0,
  username: '',
  password: '',
  database: '',
  dialectOptions: {
    ssl: { rejectUnauthorized: false },
  },
});

sequelize.authenticate().then(
  () => console.log('success'),
  (error) => console.error(error),
);

The simplest way to verify this is to run:

kubectl run -ti test-pg-connection --image node:12-slim -- bash

Then inside the container type:

mkdir app
cd app
yarn init
yarn add sequelize pg pg-hstore
node

Modify the script and paste it into the node console.

I don’t think rejectUnauthorized: false is the right option. You typically want to reject unauthorized identities. Not verifying the identity of the server has the potential to leave you open to a man-in-the-middle attack.

Digital Ocean provides the CA certificate in the database connection details. Download the CA certificate and ensure you are connecting to the database using that certificate.

If you’re using knex, your knexfile would resemble the following:

const fs = require("fs");

module.exports = {

    development: {
        client: "pg",
        connection: {
            database: "<database name>",
            user: "<username>",
            password: "<password>",
            host: "<host>",
            port: "<port>",
            ssl: {
                // Ensure we *are* rejecting unauthorized identities 
                rejectUnauthorized: true, 

                // Path to the downloaded digital ocean cert
                ca: fs.readFileSync("ca-certificate.crt").toString()
            },
        },

        ... other knex settings such as pool
    }

}