How to Get Rid of a Self-Signed Certificate (EdgeDB)

Hello! I’m trying to set up EdgeDB in my droplet so I can use the EdgeDB API with a Bubble app. The problem is during my initial set-up, I had EdgeDB generate a self-signed certificate, and Bubble doesn’t accept those. Over the weekend, I added a domain to my account and a Let’s Encrypt certificate (though DigitalOcean) to it, but Bubble still detects the self-signed certificate.

Nothing I’ve tried seems to be getting rid of it. I relinked the EdgeDB instance with my certificate file, I deleted what appeared to be the certificate file (filename = “cert.pem”), and I attempted to add ENV variables (though I’m not actually sure where they need to be). Same result every time.

How do I remove the self-signed certificate and use my new Let’s Encrypt certificate?

In case this helps, I’m not using a Docker container.

Submit an answer

This textbox defaults to using Markdown to format your answer.

You can type !ref in this text area to quickly search our full set of tutorials, documentation & marketplace offerings and insert the link!

Sign In or Sign Up to Answer

These answers are provided by our Community. If you find them useful, show some love by clicking the heart. If you run into issues leave a comment, or add your own answer to help others.

Bobby Iliev
Site Moderator
Site Moderator badge
April 23, 2024

Hi there,

As far as I can see from the docs here:

You can start the edgedb-server process with the --tls-cert-file and --tls-key-file flags so that you can point it to the correct Let’s Encrypt SSL files.

Basically first make sure that your Let’s Encrypt certificates are correctly installed and accessible on your Droplet:

ls -l /etc/letsencrypt/live/

Make sure that the EdgeDB service user has the necessary permissions to read the certificate and key files. You might need to adjust permissions or add the EdgeDB user to a group that has read access to the Let’s Encrypt files.

sudo chown root:edgedb /etc/letsencrypt/live/*
sudo chmod 750 /etc/letsencrypt/live/
sudo chmod 640 /etc/letsencrypt/live/*

And then if the files are there with the correct permissions. Then you need to configure EdgeDB to use your Let’s Encrypt certificate instead of the self-signed certificate, if you’re starting EdgeDB manually, you can use command-line arguments like this:

edgedb-server --tls-cert-file=/etc/letsencrypt/live/ --tls-key-file=/etc/letsencrypt/live/

If EdgeDB is set up as a service, you might need to edit its service configuration file, usually located in /etc/systemd/system/ or /lib/systemd/system/:

Description=EdgeDB Server

ExecStart=/usr/bin/edgedb-server --tls-cert-file=/etc/letsencrypt/live/ --tls-key-file=/etc/letsencrypt/live/


After modifying the configuration, reload the systemd manager configuration and restart the EdgeDB service:

sudo systemctl daemon-reload
sudo systemctl restart edgedb-server

Feel free to share how the service was setup exactly and I will be happy to look into it further.



Try DigitalOcean for free

Click below to sign up and get $200 of credit to try our products over 60 days!

Sign up

Get our biweekly newsletter

Sign up for Infrastructure as a Newsletter.

Hollie's Hub for Good

Working on improving health and education, reducing inequality, and spurring economic growth? We'd like to help.

Become a contributor

Get paid to write technical tutorials and select a tech-focused charity to receive a matching donation.

Welcome to the developer cloud

DigitalOcean makes it simple to launch in the cloud and scale up as you grow — whether you're running one virtual machine or ten thousand.

Learn more
DigitalOcean Cloud Control Panel