From 12c21b3ee28275f989b383dbecbd966edfde4499 Mon Sep 17 00:00:00 2001 From: Fardeen Mohammad Date: Fri, 13 Nov 2026 17:30:51 +0530 Subject: [PATCH 1/2] docs: show custom CA with a connection string without SSL parameters --- docs/pages/features/ssl.mdx | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/docs/pages/features/ssl.mdx b/docs/pages/features/ssl.mdx index 6a29ed739..f00c5b403 100644 --- a/docs/pages/features/ssl.mdx +++ b/docs/pages/features/ssl.mdx @@ -49,6 +49,23 @@ const config = { } ``` +To keep the CA certificate in the `ssl` object, use a connection string without those SSL query parameters: + +```js +import fs from 'node:fs' +import { Pool } from 'pg' + +const pool = new Pool({ + connectionString: 'postgres://user:password@localhost:5432/db?application_name=example', + ssl: { + ca: fs.readFileSync('/path/to/server-certificates/root.crt'), + rejectUnauthorized: true, + }, +}) +``` + +Here TLS is enabled by the `ssl` object, and the server certificate is verified against the supplied CA. Other query parameters, such as `application_name`, can remain in the connection string. If your provider supplies a URL containing SSL parameters, remove those parameters before using this configuration and keep all required TLS settings in the `ssl` object. + ## Direct SSL negotiation By default node-postgres uses the traditional PostgreSQL SSL negotiation: it sends an `SSLRequest` packet, waits for the server to acknowledge it, and only then starts the TLS handshake. PostgreSQL 17 and newer also support _direct_ SSL negotiation, where the TLS handshake begins immediately on connect (similar to HTTPS), saving one network round-trip. From c8ba3ee5f1165cf64be8c956430107519b446227 Mon Sep 17 00:00:00 2001 From: Fardeen Mohammad Date: Sun, 15 Nov 2026 18:04:15 +0530 Subject: [PATCH 2/2] docs: omit default rejectUnauthorized option --- docs/pages/features/ssl.mdx | 1 - 1 file changed, 1 deletion(-) diff --git a/docs/pages/features/ssl.mdx b/docs/pages/features/ssl.mdx index f00c5b403..68e4ab199 100644 --- a/docs/pages/features/ssl.mdx +++ b/docs/pages/features/ssl.mdx @@ -59,7 +59,6 @@ const pool = new Pool({ connectionString: 'postgres://user:password@localhost:5432/db?application_name=example', ssl: { ca: fs.readFileSync('/path/to/server-certificates/root.crt'), - rejectUnauthorized: true, }, }) ```