Question

How to add SSL certificate to App Platform environment variables in order to connect to Managed Database

Posted March 6, 2021 1.3k views
DigitalOcean Managed PostgreSQL DatabaseDigitalOcean App Platform

The current code I have set up works fine, but it is not secure.

const { Pool } = require('pg')

const pgPool = new Pool({
    user: process.env.PGUSER,
    password: process.env.PGPASSWORD,
    host: process.env.PGHOST,
    database: process.env.PGDATABASE,
    port: process.env.PGPORT,
    ssl: {
        rejectUnauthorized: false
    },
})

What I would like the ssl object to look like is this.

ssl: {
   rejectUnauthorized: true,
   ca: process.env.CACERT,
  },

Unfortunately I am having trouble figuring out how to put make the certificate available to my app.I would prefer not to commit the certificate to my source control..

Thanks,
Peter

These answers are provided by our Community. If you find them useful, show some love by clicking the heart. If you run into issues leave a comment, or add your own answer to help others.

×
Submit an Answer
2 answers

Hi there @peterjf2,

You would need to pass the CA certificate to your application as an environment variable.

You can refer to the CA_CERT variable which holds the CA certificate for the Managed databases.

For more information on how to use the environment variables on the App platform, I could suggest taking a look at the official documentation here:

https://www.digitalocean.com/docs/app-platform/how-to/use-environment-variables/

Hope that this helps.
Regards,
Bobby

Okay, for anyone else who gets stuck on this, I had to put the entire cert into double quotes and add a \n after each line.

So now my database connection code looks like

const { Pool } = require('pg')
const fs = require('fs')

const pgPool = new Pool({
user: process.env.PGUSER,
password: process.env.PGPASSWORD,
host: process.env.PGHOST,
database: process.env.PGDATABASE,
port: process.env.PGPORT,
ssl: {
    rejectUnauthorized: true,
    // ca: fs.readFileSync(
    //     `${process.cwd()}/cert/ca-certificate.crt`.toString()
    // ),
    ca: process.env.CA_CERT,
},
})
.on('connect', () => {
    console.log('connected to the database!')
})
.on('error', (err) => {
    console.log('error connecting to database ', err)
})

with the CA_CERT env for dotenv and my App Platform looks like:

CA_CERT="-----BEGIN CERTIFICATE-----\nVALUES HERE WITH NO SPACES AND A \n 
AFTER EACH LINE\n-----END CERTIFICATE-----"

I go a little bit more into detail in my stack overflow question here:
Example link

I do not think it is possible to do this with the $7 development database as I was unable to find a CA_cert anywhere to download. Would probably just have to leave the unauthorized portion as false.

  • Hi,

    I have tried the solution you proposed but it doesn’t work for me. I run my node app in docker container. It tries to connect to the Database but throws an error:

    Error: connect ECONNREFUSED <IP>:25060
    at TCPConnectWrap.afterConnect [as oncomplete] (node:net:1133:16) {
    errno: -111,
    code: ‘ECONNREFUSED’,
    syscall: 'connect’,
    address: <IP>,
    port: 25060,
    statusCode: 500,
    status: 'error’
    }