Skip to content

SSL settings are not deep merged with params parsed from connectionString #2380

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
jgeurts opened this issue Oct 15, 2020 · 1 comment
Open

Comments

@jgeurts
Copy link
Contributor

jgeurts commented Oct 15, 2020

Hi Brian, I wanted to drop a note that #2345 broke my connection. I was using a configuration similar to:

{
  connectionString: 'postgres://foo:[email protected]/my_db?sslmode=verify-full',
  ssl: {
    rejectUnauthorized: true,
    ca: fs.readFileSync(path.join(__dirname, './certs/rds-ca-2019-root.pem')).toString(),
    minVersion: 'TLSv1.2',
  },
}

I'm not totally sure why I had sslmode in the url - I think it had to do with ssl settings in pg v7. It looks like with #2345 merged in, the config merging at https://github.com/brianc/node-postgres/blob/master/packages/pg/lib/connection-parameters.js#L56 would wipe out the ssl object.

It's an easy enough fix by moving the sslmode setting from the connection string to the ssl object. I wanted to drop a note here, though, in case you wanted to support deep merging connection string options with config settings.

fwiw, if anyone else is searching for something related to this, the error that was thrown was

Error: unable to get local issuer certificate
    at TLSSocket.onConnectSecure (_tls_wrap.js:1502:34)
    at TLSSocket.emit (events.js:314:20)
    at TLSSocket.EventEmitter.emit (domain.js:483:12)
    at TLSSocket._finishInit (_tls_wrap.js:937:8)
    at TLSWrap.ssl.onhandshakedone (_tls_wrap.js:711:12)
@jgeurts
Copy link
Contributor Author

jgeurts commented Oct 15, 2020

Actually, it seems that maybe I don't need to add sslmode to the ssl configuration object... The rejectUnauthorized: true would essentially accomplish the same, right?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant