#Deploying Prisma to DigitalOcean's AppPlatform - Constantly getting TlsConnectionError

3 messages · Page 1 of 1 (latest)

sage void
#

Hello Guys,
I am trying to deploy my PrismaORM Project to DigitalOceans AppPlatform.

The initial migrate deploy works fine but when im trying to use the client to fetch Data from the Database i get TlsConnectionError every time.

Dec 09 17:39:08 Error opening a TLS connection: self-signed certificate in certificate chain

Anyone having some experience with deploying prisma projects to DO? Im also using a Managed Database from DigitalOcean

edgy sonnetBOT
#

You've gone full bot mode! Let me fetch that AI answer for you ASAP.

edgy sonnetBOT
# edgy sonnet You've gone full bot mode! Let me fetch that AI answer for you ASAP.

The TLS errors you’re seeing with DigitalOcean Managed PostgreSQL are related to SSL certificate handling between Prisma and DO’s self‑signed CA.

From the docs and current open issue, there are two main approaches:

1. Recommended: provide DO’s CA cert file

Download the CA certificate from your DigitalOcean Managed DB dashboard and mount it with your app. Then use a connection string like:

DATABASE_URL="postgresql://USER:PASSWORD@HOST:PORT/DB?sslmode=verify-full&sslrootcert=/app/ca-cert.crt"

This is confirmed to work with Prisma 7 on DigitalOcean managed Postgres.[DO TLS issue]

2. Using sslaccept=accept_invalid_certs (currently unreliable)

Prisma documents sslaccept=accept_invalid_certs to bypass strict certificate checks.[SSL options]
However, multiple users report that with Prisma 7 this flag is not honored for DigitalOcean and they still receive:

Error opening a TLS connection: self-signed certificate in certificate chain

even with:

DATABASE_URL="postgresql://USER:PASSWORD@HOST:PORT/DB?sslmode=require&sslaccept=accept_invalid_certs"

This worked in Prisma 6.9 but is broken in Prisma 7.[DO TLS issue]

What you can do now

  1. Use the CA-cert approach (sslmode=verify-full&sslrootcert=...) in App Platform.
  2. Ensure your DATABASE_URL in App Platform matches exactly what works locally.
  3. If you’re on Prisma 7 and want accept_invalid_certs, be aware this is a known open issue and may not currently work with DigitalOcean.

If you still hit TLS errors even with sslrootcert, the knowledge sources don’t provide more specific DigitalOcean/App Platform fixes beyond this.