Threads

After upgrading from Prisma 6 to Prisma 7, every query crashes with "Error opening a TLS connection: self-signed certificate in certificate chain" (PrismaClientKnownRequestError, code P1011). The app itself returns 200 but dies at the first prisma.user.findUnique() call. Prisma 7 changed the underlying pg driver defaults, so sslmode settings that were tolerated before are now treated as verify-full, and a self-signed or custom CA in the chain (common with Aiven, RDS, or corporate Postgres) fails the handshake.

Append sslmode and sslrootcert to your DATABASE_URL: ?sslmode=verify-full&sslrootcert=./certificates/global-bundle.pem (adjust the path; for RDS the bundle is at https://truststore.pki.rds.amazonaws.com/global/global-bundle.pem, for Aiven download the CA certificate from the console). This was confirmed working on Prisma 7.5.0 by a reporter who hit the same error. Note that sslmode=require and sslmode=verify-ca now behave as aliases for verify-full under Prisma 7's pg driver, so set verify-full explicitly. Maintainers point at https://github.com/prisma/prisma/issues/27611 as the root-cause thread. Source: https://github.com/prisma/prisma/issues/29060