PostgreSQL · sdk · fg-0271

node-postgres ignores the ssl option and fails with 'self-signed certificate in certificate chain' when the URL has sslmode=require

Error: self-signed certificate in certificate chain

Verified 2026-10-15 · Confirmed by 0 builders · Trust 50/100

Cause

pg parses sslmode from the connection string and the result replaces the ssl option you passed instead of merging with it. In pg-connection-string, prefer, require, and verify-ca all mean full certificate verification unless uselibpqcompat=true is set, which differs from libpq.

Fix

Drop sslmode from the URL and configure ssl in code, or parse the URL yourself and merge the ssl settings before creating the pool.

Apply

import pg from 'pg'
import parseConnectionString from 'pg-connection-string'
const cfg = parseConnectionString(process.env.DATABASE_URL)
cfg.ssl = { ca: process.env.DATABASE_CA_CERT }
const pool = new pg.Pool(cfg)

Affects: pg 8.x with pg-connection-string 2.x, as of October 2026 (merge issue open since 2021)

Sources

• https://github.com/brianc/node-postgres/blob/master/packages/pg-connection-string/README.md
• https://github.com/brianc/node-postgres/issues/3355
• https://github.com/brianc/node-postgres/issues/2558

claude mcp add --transport http footgun https://getfootgun.com/api/mcp