{"record":{"id":"de1276079e381838","repo":"brianc/node-postgres","slug":"security-warning-using-sslmode-verify-ca-requires","errorCode":null,"errorMessage":"SECURITY WARNING: Using sslmode=verify-ca requires specifying a CA with sslrootcert. If a public CA is used, verify-ca allows connections to a server that somebody else may have registered with the CA, making you vulnerable to Man-in-the-Middle attacks. Either specify a custom CA certificate with sslrootcert parameter or use sslmode=verify-full for proper security.","messagePattern":"SECURITY WARNING: Using sslmode=verify-ca requires specifying a CA with sslrootcert\\. If a public CA is used, verify-ca allows connections to a server that somebody else may have registered with the CA, making you vulnerable to Man-in-the-Middle attacks\\. Either specify a custom CA certificate with sslrootcert parameter or use sslmode=verify-full for proper security\\.","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/pg-connection-string/index.js","lineNumber":127,"sourceCode":"        config.ssl = false\n        break\n      }\n      case 'prefer': {\n        config.ssl.rejectUnauthorized = false\n        break\n      }\n      case 'require': {\n        if (config.sslrootcert) {\n          // If a root CA is specified, behavior of `sslmode=require` will be the same as that of `verify-ca`\n          config.ssl.checkServerIdentity = function () {}\n        } else {\n          config.ssl.rejectUnauthorized = false\n        }\n        break\n      }\n      case 'verify-ca': {\n        if (!config.ssl.ca) {\n          throw new Error(\n            'SECURITY WARNING: Using sslmode=verify-ca requires specifying a CA with sslrootcert. If a public CA is used, verify-ca allows connections to a server that somebody else may have registered with the CA, making you vulnerable to Man-in-the-Middle attacks. Either specify a custom CA certificate with sslrootcert parameter or use sslmode=verify-full for proper security.'\n          )\n        }\n        config.ssl.checkServerIdentity = function () {}\n        break\n      }\n      case 'verify-full': {\n        break\n      }\n    }\n  } else {\n    switch (config.sslmode) {\n      case 'disable': {\n        config.ssl = false\n        break\n      }\n      case 'prefer':\n      case 'require':","sourceCodeStart":109,"sourceCodeEnd":145,"githubUrl":"https://github.com/brianc/node-postgres/blob/ff9d775abd12f29dd6df03945253b54eabbb29f2/packages/pg-connection-string/index.js#L109-L145","documentation":"Error \"SECURITY WARNING: Using sslmode=verify-ca requires specifying a CA with sslrootcert. If a public CA is used, verify-ca allows connections to a server that somebody else may have registered with the CA, making you vulnerable to Man-in-the-Middle attacks. Either specify a custom CA certificate with sslrootcert parameter or use sslmode=verify-full for proper security.\" thrown in brianc/node-postgres.","triggerScenarios":"Thrown at packages/pg-connection-string/index.js:127 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":[],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"ff9d775abd12f29dd6df03945253b54eabbb29f2","analyzedAt":"2026-08-11T15:33:59.644Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}