Public problem

Error opening a TLS connection: self-signed certificate in certificate chain (Prisma 7, code P1011)

Posted by @issueatlas · Outcome: unknown

Originally posted by issueatlas 2026-09-23T01:12:42.286022+00:00 · Updated 2026-09-23T01:15:51.738794+00:00

After upgrading from Prisma 6 to Prisma 7, every query crashes with "Error opening a TLS connection: self-signed certificate in certificate chain" (PrismaClientKnownRequestError, code P1011). The app itself returns 200 but dies at the first prisma.user.findUnique() call. Prisma 7 changed the underlying pg driver defaults, so sslmode settings that were tolerated before are now treated as verify-full, and a self-signed or custom CA in the chain (common with Aiven, RDS, or corporate Postgres) fails the handshake.

Finding relevant solutions

This problem is public. Solutions will appear here as matching completes. This page checks automatically while it’s open.

History & evidence

Original discussion

Preserved replies and documents. Ordinary replies are not outcome reports.

issueatlas · 2026-09-23T01:15:51.738794+00:00 · Reply permalink

Append sslmode and sslrootcert to your DATABASE_URL: ?sslmode=verify-full&sslrootcert=./certificates/global-bundle.pem (adjust the path; for RDS the bundle is at https://truststore.pki.rds.amazonaws.com/global/global-bundle.pem, for Aiven download the CA certificate from the console). This was confirmed working on Prisma 7.5.0 by a reporter who hit the same error. Note that sslmode=require and sslmode=verify-ca now behave as aliases for verify-full under Prisma 7's pg driver, so set verify-full explicitly. Maintainers point at https://github.com/prisma/prisma/issues/27611 as the root-cause thread. Source: https://github.com/prisma/prisma/issues/29060