PostgreSQL on App Platform – Self-Signed Certificate in Certificate Chain issue

Hi all,

I’m deploying a Node.js app on DigitalOcean App Platform that connects to a DigitalOcean-managed PostgreSQL database. I’m using drizzle-orm for database access.

I’m consistently getting this error during login/auth operations: Error: self-signed certificate in certificate chain at /workspace/node_modules/pg-pool/index.js:45:11 ... code: 'SELF_SIGNED_CERT_IN_CHAIN'

#What I’ve already tried:

• Downloaded the CA cert (digitalocean-ca.crt) from the database “Connection” page.
• Placed it in ./certs/digitalocean-ca.crt in my repo.
• In my db.ts, I’m reading and injecting it like this:

import { drizzle } from 'drizzle-orm/node-postgres';
import { Pool } from 'pg';
import fs from 'fs';
import path from 'path';

const certPath = path.resolve(__dirname, '../../certs/digitalocean-ca.crt');

const pool = new Pool({
  connectionString: process.env.DATABASE_URL,
  ssl: {
    rejectUnauthorized: true,
    ca: fs.readFileSync(certPath).toString(),
  },
});

export const db = drizzle(pool);

• Verified the cert path exists during runtime (logged with fs.existsSync()).
• DATABASE_URL is clean (no sslmode=disable or ?ssl=false I am using sslmode=enable).
• When I change to rejectUnauthorized: false, everything works — but that’s insecure and not an option for production.

So my question is: Firstly, why is there not an option to simply disable the SSL requirement? I don’t want the communication between the database server and my app to be secured. I’ve already set trusted apps, so it doesn’t need an SSL layer as well, in my opinion.

• If we cannot disable this requirement, how do I fix this issue in my app? I am tired of trying to resolve this, I am stuck not able to log in to my test app because of this.

exact error

[AUTH] Login error after 80 ms: Error: self-signed certificate in certificate chain
[layerr-app-prod] [2025-06-26 05:39:58]     at /workspace/node_modules/pg-pool/index.js:45:11
[layerr-app-prod] [2025-06-26 05:39:58]     at process.processTicksAndRejections (node:internal/process/task_queues:105:5)
[layerr-app-prod] [2025-06-26 05:39:58]     at async file:///workspace/node_modules/drizzle-orm/node-postgres/session.js:83:22
[layerr-app-prod] [2025-06-26 05:39:58]     at async DatabaseStorage.getUserByEmail (file:///workspace/dist/index.js:3306:22)
[layerr-app-prod] [2025-06-26 05:39:58]     at async file:///workspace/dist/index.js:4786:20 {
[layerr-app-prod] [2025-06-26 05:39:58]   code: 'SELF_SIGNED_CERT_IN_CHAIN'

Thanks in advance.

Aasim