immich-app/immich
1
0
Fork 0
mirror of https://github.com/immich-app/immich.git synced 2026-02-05 00:30:57 +03:00
Code Issues 11 Packages Projects Releases 10 Wiki Activity

Error: self signed certificate in certificate chain when connecting to TLS enabled Postgres instance with sslmode=prefer #1064

New Issue
Closed
opened 2026-02-05 00:17:51 +03:00 by OVERLORD · 2 comments
OVERLORD commented 2026-02-05 00:17:51 +03:00
Owner
Copy Link

Originally created by @NiklasRosenstein on GitHub (Jul 7, 2023).

The bug

This is a follow up to https://github.com/immich-app/immich/issues/902. I'm connecting to a Postgres database that uses TLS. I don't want to verify the CA, but I want to ensure that Immich connects to the Postgres cluster with SSL.

The DB_URL I pass is postgresql://immich:password@postgres-main-primary.default.svc:5432/immich?sslmode=prefer. According to the Postgres documentation, prefer means that SSL will be used if available, but the CA will not be verified. Yet, Immich fails to start with the following error:

[Nest] 1  - 07/06/2023, 11:42:05 PM   ERROR [ExceptionHandler] self signed certificate in certificate chain
Error: self signed certificate in certificate chain
    at TLSSocket.onConnectSecure (node:_tls_wrap:1532:34)
    at TLSSocket.emit (node:events:527:28)
    at TLSSocket._finishInit (node:_tls_wrap:946:8)
    at TLSWrap.ssl.onhandshakedone (node:_tls_wrap:727:12)

The expected behaviour would be to use SSL but ignore the fact that the certificate is not trusted.

The OS that Immich Server is running on

Kubernetes, Ubuntu 22

Version of Immich Server

v1.53.0 v1.66.1

Version of Immich Mobile App

n/a

Platform with the issue

  • Server
  • Web
  • Mobile

Your docker-compose.yml content

Using https://github.com/immich-app/immich-charts/ v0.1.2

Your .env content

See `DB_URL` above

Reproduction steps

1. Set up Postgres cluster with TLS with self-signed certificate
2. Try to connect Immich to it

Additional information

No response

Originally created by @NiklasRosenstein on GitHub (Jul 7, 2023). ### The bug This is a follow up to https://github.com/immich-app/immich/issues/902. I'm connecting to a Postgres database that uses TLS. I don't want to verify the CA, but I want to ensure that Immich connects to the Postgres cluster with SSL. The `DB_URL` I pass is `postgresql://immich:password@postgres-main-primary.default.svc:5432/immich?sslmode=prefer`. According to the [Postgres documentation](https://www.postgresql.org/docs/9.1/libpq-ssl.html#LIBPQ-SSL-SSLMODE-STATEMENTS), `prefer` means that SSL will be used if available, but the CA will not be verified. Yet, Immich fails to start with the following error: ``` [Nest] 1 - 07/06/2023, 11:42:05 PM ERROR [ExceptionHandler] self signed certificate in certificate chain Error: self signed certificate in certificate chain at TLSSocket.onConnectSecure (node:_tls_wrap:1532:34) at TLSSocket.emit (node:events:527:28) at TLSSocket._finishInit (node:_tls_wrap:946:8) at TLSWrap.ssl.onhandshakedone (node:_tls_wrap:727:12) ``` The expected behaviour would be to use SSL but ignore the fact that the certificate is not trusted. ### The OS that Immich Server is running on Kubernetes, Ubuntu 22 ### Version of Immich Server ~v1.53.0~ v1.66.1 ### Version of Immich Mobile App n/a ### Platform with the issue - [X] Server - [ ] Web - [ ] Mobile ### Your docker-compose.yml content ```YAML Using https://github.com/immich-app/immich-charts/ v0.1.2 ``` ### Your .env content ```Shell See `DB_URL` above ``` ### Reproduction steps ```bash 1. Set up Postgres cluster with TLS with self-signed certificate 2. Try to connect Immich to it ``` ### Additional information _No response_
OVERLORD commented 2026-02-05 00:18:05 +03:00
Author
Owner
Copy Link

@NiklasRosenstein commented on GitHub (Jul 7, 2023):

I realized there's a comment about "not requiring a CA certificate" in #902, but I can't figure out how I would go about configuring this.

This should be enough to allow SSL connections without requiring a CA certificate:

  ssl: {
    require: true,
    rejectUnauthorized: false
  }
@NiklasRosenstein commented on GitHub (Jul 7, 2023): I realized there's a comment about "not requiring a CA certificate" in #902, but I can't figure out how I would go about configuring this. > This should be enough to allow SSL connections without requiring a CA certificate: > > ``` > ssl: { > require: true, > rejectUnauthorized: false > } > ```
OVERLORD commented 2026-02-05 00:18:11 +03:00
Author
Owner
Copy Link

@someonewating commented on GitHub (Jul 9, 2023):

Hi @NiklasRosenstein . Can you share how do you passed DB_URL to the container?

@someonewating commented on GitHub (Jul 9, 2023): Hi @NiklasRosenstein . Can you share how do you passed `DB_URL ` to the container?
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
accessibility
changelog:enhancement
changelog:security
changelog:translation
cli
date-time
documentation
external-library
format
good first issue
needs-answer
nice to have
sharing
tech-debt
📱mobile
🖥️web
🗄️server
🧠machine-learning
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
OVERLORD
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: immich-app/immich#1064
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?