Unable to use ssl mode with my DB.

[PrashantRaj18198]

I'm trying to self-host boxy, and running into issues where the ssl connection in not verified. I ran into an issue where the boxy container was complaining

{"level":50,"time":"2025-05-19T05:24:18.135Z","pid":1,"hostname":"jackson-d8794cf84-gpt8m","msg":"error connecting to engine: sql, type: postgres db: Error: unable to verify the first certificate"}

This was when I sent the DB_URL as ...ssl_mode=require.

The DB is a GCP Postgres Instance. I also tried with AWS RDS Postgres and it has the same issue. For ssl_mode=require to work we generally don't have to setup additional certs.

I'm wondering if this is a bug on boxy's side or something I've misconfigured.

[deepakprabhakara]

Please check this section and let us know if adding the no-verify option fixes your issue - https://boxyhq.com/docs/jackson/deploy/env-variables#db_url

[PrashantRaj18198]

If we do no-verify, doesn't that skip the cert checking with CA?

[PrashantRaj18198]

Also while trying to do cert verification using the verify-ca as the ssl_mode, I'm getting the error log below. This seems to give me the below error.

{"level":50,"time":"2025-05-19T09:20:42.726Z","pid":1,"hostname":"jackson-d894f6669-tw68m","msg":"error connecting to engine: sql, type: postgres db: Error [ERR_TLS_CERT_ALTNAME_INVALID]: Hostname/IP does not match certificate's altnames: Host: localhost. is not in the cert's altnames: DNS:1-1c35d9cd-e5f8-45da-98ad-9fb143eac5d3.us-central1.sql.goog"}
psql "sslmode=verify-ca sslrootcert=server-ca.pem sslcert=client-cert.pem sslkey=client-key.pem hostaddr=<redacted> port=5432 user=postgres dbname=postgres"

But connecting using the same set of inputs via the psql client cli is letting me access the db instance.

[PrashantRaj18198]

The host address here is the public IP that GCP assigns to their SQL instances.

[deepakprabhakara]

Aah looks like we'll have to support sslrootcert, sslcert and sslkey equivalent (ca, cert and key in node-postgres - https://node-postgres.com/features/ssl). Please feel free to open a PR for this, you would pass this into https://github.com/boxyhq/jackson/blob/main/lib/env.ts#L23, probably best to read file paths since passing the content as env vars might run into length limits.