Question

How to add SSL certificate to App Platform environment variables in order to connect to Managed Database

Posted March 6, 2021 2.9k views
DigitalOcean Managed PostgreSQL DatabaseDigitalOcean App Platform

The current code I have set up works fine, but it is not secure.

const { Pool } = require('pg')

const pgPool = new Pool({
    user: process.env.PGUSER,
    password: process.env.PGPASSWORD,
    host: process.env.PGHOST,
    database: process.env.PGDATABASE,
    port: process.env.PGPORT,
    ssl: {
        rejectUnauthorized: false
    },
})

What I would like the ssl object to look like is this.

ssl: {
   rejectUnauthorized: true,
   ca: process.env.CACERT,
  },

Unfortunately I am having trouble figuring out how to put make the certificate available to my app.I would prefer not to commit the certificate to my source control..

Thanks,
Peter

These answers are provided by our Community. If you find them useful, show some love by clicking the heart. If you run into issues leave a comment, or add your own answer to help others.

×
Submit an Answer
2 answers

Hi there @peterjf2,

You would need to pass the CA certificate to your application as an environment variable.

You can refer to the CA_CERT variable which holds the CA certificate for the Managed databases.

For more information on how to use the environment variables on the App platform, I could suggest taking a look at the official documentation here:

https://www.digitalocean.com/docs/app-platform/how-to/use-environment-variables/

Hope that this helps.
Regards,
Bobby

Okay, for anyone else who gets stuck on this, I had to put the entire cert into double quotes and add a \n after each line.

So now my database connection code looks like

const { Pool } = require('pg')
const fs = require('fs')

const pgPool = new Pool({
user: process.env.PGUSER,
password: process.env.PGPASSWORD,
host: process.env.PGHOST,
database: process.env.PGDATABASE,
port: process.env.PGPORT,
ssl: {
    rejectUnauthorized: true,
    // ca: fs.readFileSync(
    //     `${process.cwd()}/cert/ca-certificate.crt`.toString()
    // ),
    ca: process.env.CA_CERT,
},
})
.on('connect', () => {
    console.log('connected to the database!')
})
.on('error', (err) => {
    console.log('error connecting to database ', err)
})

with the CA_CERT env for dotenv and my App Platform looks like:

CA_CERT="-----BEGIN CERTIFICATE-----\nVALUES HERE WITH NO SPACES AND A \n 
AFTER EACH LINE\n-----END CERTIFICATE-----"

I go a little bit more into detail in my stack overflow question here:
Example link

I do not think it is possible to do this with the $7 development database as I was unable to find a CA_cert anywhere to download. Would probably just have to leave the unauthorized portion as false.

  • Hi,

    I have tried the solution you proposed but it doesn’t work for me. I run my node app in docker container. It tries to connect to the Database but throws an error:

    Error: connect ECONNREFUSED <IP>:25060
    at TCPConnectWrap.afterConnect [as oncomplete] (node:net:1133:16) {
    errno: -111,
    code: ‘ECONNREFUSED’,
    syscall: 'connect’,
    address: <IP>,
    port: 25060,
    statusCode: 500,
    status: 'error’
    }

    • Hello @wamujlb,

      I had the same difficulty, the extra escape character \n never helped, I used this snippet to extract the content of my cert into a file name mongo-cert:

      require('dotenv').config();
      const fs = require("fs");
      
      fs.writeFile(`./mongo-cert`, fs.readFileSync(`./ca-certificate.crt`), err => {
        if (err) return console.log(err);
      })
      

      The content looks somewhat like this (I reduced it):

      -----BEGIN CERTIFICATE-----
      oeNlHXc96UpiUks/71GTXLYU84q/uRGs3fX6Ihd54nrbnk1S+qVTWzqnt0MWDFDJ
      Pt2TyMRHl3zmqqv613C5IIVutN4eTqYen9L29akw3HRXI1V3eoOXm8+1X30ic1/R
      e5Q6sz+uFX87aMcRtmjZJOw5AjmBbX+KFy9UTw71YtkUEC9WyV+fKXtvpF7z2bl2
      aRROROZAkfyjKqt6Ie9LLNgXfdh9nu6hqZxzeWW+dci+zgxN0wlT7ywr5WOJmCyq
      NcBy9o2hQhGRbS1ef6b7JaPHViV9pv2cgOIx1O29VsWbTQ7iySYTqAdQV0JN46iq
      Lsf+oTU8lMtyWmEXkCMyKPut+JmcaXjlCg+p3S2w9kglD1S+czw2covFlem4o4+N
      qbJix9ZdJmag2C453wLQ6Gh+cBIM08eWJwKQiQXRWeAHPKKOMJmydHofPwfw/L8H
      7elMA8bkDDJp22MbFVspt7K9Yc1HCyeRmSGNrGgMSB4x7cNvgYMCAwEAAaNFMEMw
      DgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8CAQAwHQYDVR0OBBYEFJa/
      dYnafq+2Lz5pVImJ5I6DAdIiMA0GCSqGSIb3DQEBCwUAA4ICAQC0SwM2+s+apJSQ
      7KQszXlQ1B79up9/2+91++NYSMoHiQ==
      -----END CERTIFICATE-----
      

      I copied it as it is into DigitalOcean’s environmental variables with the key CA_CERT, though for local dev .env, the escape character work just fine.

      I hope this helps.