self signed certificate error

[eric-elsholz]

Hi. Sorry ahead of time, I don't have a lot of detail here. We updated our packages today and afterwards started seeing a connection error from Sequelize ORM: "self signed certificate". We do in fact use a self signed certificate but this has never been a problem for us in the past. We downgraded from pg@7.13.0 to pg@7.4.3 and then we were able to connect again.

[ianwremmel]

If I’m reading bf029c8 correctly, I think there may have been a bunch of options (including rejectUnauthorized) being inadvertently set to falsy values. They are now not set at all unless you pass them in. The last release was a breaking change, but it’s probably easiest to fix by passing rejectUnauthorized: false to pg.

[ianwremmel]

Sorry, I think I actually meant checkServerIdentity.

[charmander]

I think there may have been a bunch of options (including rejectUnauthorized) being inadvertently set to falsy values

tls.connect treats rejectUnauthorized: undefined as rejectUnauthorized: false? … It does. Oh no. :(

Well, it’s a good thing that was fixed. We should probably add a test for it. It might also be worth a security announcement (@brianc).

[powerc9000]

God I thought I was going crazy! Thanks for this info rolling back to 7.12 worked for me.

[eldimious]

I am facing the same issue. Rolling back to 7.12.1 worked for me too.

[znarf]

Spotted that in our staging system (heroku), happy to give more details.

[BrandonZacharie]

I'm using Sequelize as well and I got the "self signed certificate in chain" error until I rolled back to 7.12.1

[Kinetic-Pulse]

This one one of the most painful bugs I had to identify.
Probably shouldnt do too many updates at once but ye....
Downgrading is the way for now ~7.12.1

[ptpt]

Same here. Very hard to identify. The only error message we got is:

Error: self signed certificate in certificate chain
    at TLSSocket.onConnectSecure (_tls_wrap.js:1321:34)
    at TLSSocket.emit (events.js:210:5)
    at TLSSocket.EventEmitter.emit (domain.js:476:20)
    at TLSSocket._finishInit (_tls_wrap.js:794:8)
    at TLSWrap.ssl.onhandshakedone (_tls_wrap.js:608:12) {
  code: 'SELF_SIGNED_CERT_IN_CHAIN'
}

And we noticed that it occurs when we query PSQL.

Downgraded to pg@7.4.3 and it works now.

[jsanta]

If it may help someone else, we just added the rejectUnauthorized: false, to our sequelize connection configuration:

sequelize: {
    uri:
      'postgres://postgres_user:postgres_user_password@postgres_server:5432/postgres_database',
    options: {
      database: 'postgres_database',
      dialect: 'postgres',
      host: 'postgres_server',
      port: 5432,
      username: 'your_postgres_user',
      password: 'your_postgres_user_password',
      pool: {
        max: 3,
        min: 1,
        idle: 10000,
      },
      dialectOptions: {
        ssl: {
          require: true,
          // Ref.: https://github.com/brianc/node-postgres/issues/2009
          rejectUnauthorized: false,
        },
        keepAlive: true,        
      },      
      ssl: true,
      define: {
        timestamps: false,
      },
    },
  },

lets say the error is still there, but we are not being notified, and the backend is not crashing anymore. Just adjust the configuration according to your own needs.
Best regards from Chile.

[brianc]

Gah, I apologize for this! There aren't enough tests around self-signed cert connecting with node-postgres in travis so it was missed. Totally accidental on my part! I'm going to roll out a backwards-compatible (to the 7.x line) semver patch on top of this one to make sure it behaves exactly as it should.

@charmander what do you mean about security announcement? This makes things more secure now right? By forcing unauthorized cert rejection, where as before it was ignoring it? We should probably make the defaults be the same as the node.js defaults in v8.0. Do you mean announcing the current behavior is insecure in that it allows unauthorized certs unless you specifically set rejectUnauthorized to something to true? I agree that's worth calling out. We should also re-introduce this breaking change in 8.0 (w/ a deprecation notice in the 7.x line) so we can get folks to migrate to better ssl configurations.

[brianc]

Okay - released pg@7.14.0 which reverts pg@7.13.0 🤕 sorry about that!

I'd like to get self-signed and "proper" ssl connections tested in travis. Anyone have a docker file handy that sets both of those things up? Then we can be covered on this behavior going forward.

[charmander]

@charmander what do you mean about security announcement? This makes things more secure now right? By forcing unauthorized cert rejection, where as before it was ignoring it?

@brianc Yep, it does! I meant an announcement that pg 0.8.7 through 7.12.0 don’t check certificates.

(edit)

Do you mean announcing the current behavior is insecure in that it allows unauthorized certs unless you specifically set rejectUnauthorized to something to true? I agree that's worth calling out. We should also re-introduce this breaking change in 8.0 (w/ a deprecation notice in the 7.x line) so we can get folks to migrate to better ssl configurations.

Yes, exactly that.