SSL Errors after Switching to Driver Adapters

[joekrall]

Question

I'm using Prisma with PostgreSQL on AWS RDS (connecting via RDS Proxy) using an image based off node22-alpine deployed to Fargate. I migrated to using the new prisma-client generator + Rust-free ORM, using the pg driver adapter. Upon deploy, health checks failed with logs

Invalid `prisma.$queryRaw()` invocation:

Raw query failed. Code: `28000`. Message: `no pg_hba.conf entry for host "[host]", user "[user]", database "[database]", no encryption`

I've dug around and it seems the Prisma default of sslmode=prefer is not supported by node-postgres (#27611 (comment)). Adding &sslmode=no-verify to my database connection URL is general advice. I'm just curious why the Rust-based ORM didn't throw this error. My RDS IAC sets all client connections to be encrypted using SSL/TLS. Was the Rust-based ORM silently bypassing certificate validation? (Relatedly, does this section of the AWS Deployment Caveats page refer to solely new driver adapters, or did it refer to the Rust-based too?)

How to reproduce (optional)

Expected behavior (optional)

No response

Information about Prisma Schema, Client Queries and Environment (optional)

generator client {
  provider               = "prisma-client"
  output                 = "../src/lib/generated/prisma"
  engineType             = "client"
  runtime                = "nodejs"
  moduleFormat           = "esm"
  generatedFileExtension = "ts"
  importFileExtension    = "ts"
  previewFeatures        = ["fullTextSearchPostgres"]
}

// db.server.ts
import { PrismaPg } from '@prisma/adapter-pg'
import { Prisma, PrismaClient } from '@/lib/generated/prisma/client'
import logger from './logger'

const adapter = new PrismaPg({ connectionString: process.env.DATABASE_URL })
let prisma: PrismaClient | null

if (process.env.NODE_ENV === 'production') {
  // @ts-ignore
  prisma = new PrismaClient({
    adapter,
    log: [
      {
        emit: 'event',
        level: 'query',
      },
      {
        emit: 'event',
        level: 'error',
      },
      {
        emit: 'event',
        level: 'warn',
      },
    ],
  })
} else {
  // @ts-ignore: TODO: type def for global
  if (!global.prisma) {
    // @ts-ignore
    global.prisma = new PrismaClient({ adapter })
  }
  // @ts-ignore
  prisma = global.prisma
}

// exported

• OS: macOS and Alpine Linux
• Database: PostgreSQL
• Node.js version: 22.21.0

prisma                : 6.17.1
@prisma/client        : 6.17.1
Computed binaryTarget : darwin-arm64
Operating System      : darwin
Architecture          : arm64
Node.js               : v22.18.0
TypeScript            : 5.9.3
Query Compiler        : enabled
PSL                   : @prisma/prisma-schema-wasm 6.17.1-1.272a37d34178c2894197e17273bf937f25acdeac
Schema Engine         : schema-engine-cli 272a37d34178c2894197e17273bf937f25acdeac (at node_modules/.pnpm/@prisma+engines@6.17.1/node_modules/@prisma/engines/schema-engine-darwin-arm64)
Default Engines Hash  : 272a37d34178c2894197e17273bf937f25acdeac
Studio                : 0.511.0
Preview Features      : fullTextSearchPostgres

[joekrall]

Related: #27496 (reply in thread)

[nurul3101]

Hi @joekrall!

The node-postgres (pg) driver, which powers the new Rust-free Prisma ORM, does not implement the same semantics for sslmode=prefer as the libpq (PostgreSQL native) client. In node-postgres, sslmode=prefer is effectively treated as sslmode=require, meaning it will attempt an SSL connection and fail if the server does not support SSL, rather than falling back to a non-SSL connection. See this comment on a related issue.

The error you encountered is likely a result of the pg driver not falling back to a non-SSL connection when the server requires SSL, and the connection string does not explicitly set sslmode to require or no-verify.

The Rust-based Prisma engine (used before the Rust-free/driver adapter approach) also enforced SSL by default when connecting to AWS RDS, but it appears to have been more permissive or had different defaults regarding certificate validation.

[github-actions[bot]]

Hi,

As we have not heard back from you, we are closing this discussion to keep our discussions organized.

Feel free to start a new discussion if this remains relevant.

Thank you for being part of the community!