Help Needed: VS Code Azure Extension Resolving "Self Signed Certificate in Certificate Chain" Error with Azure PostgreSQL Flexible Server

Hi @ Tom Canter

Thank you for reaching out and providing detailed steps—really appreciate the effort you’ve already made in trying to resolve the issue. The "self-signed certificate in certificate chain" error you're seeing typically occurs when the Node.js environment (which the Azure extension uses) doesn't fully trust the certificate chain presented by the Azure PostgreSQL server.

Here are a few additional steps to try that have helped in similar scenarios:

Please ensure you're using the DigiCert Global Root G2 certificate, which is what Azure PostgreSQL Flexible Server relies on.

Save it to your machine as:

C:\ProgramData\SSL\certs\DigiCert_Global_Root_G2.pem

Set it as the trusted CA for Node.js:

setx NODE_EXTRA_CA_CERTS "C:\ProgramData\SSL\certs\DigiCert_Global_Root_G2.pem"
$env:NODE_EXTRA_CA_CERTS = "C:\ProgramData\SSL\certs\DigiCert_Global_Root_G2.pem"

After setting the above environment variable, please make sure to fully close and reopen VS Code from a new terminal window so the changes take effect.

Some antiviruses or corporate proxy software can intercept SSL connections and insert their own certificates, causing trust issues.

You might want to:

• Try connecting from a different network (e.g., a mobile hotspot).
• Temporarily disable antivirus/firewall to test.
• Use a different tool like pgAdmin or DBeaver to validate SSL connectivity.

In your VS Code settings, try adding the following configuration to your settings.json file:

"http.proxyStrictSSL": false

This setting disables strict SSL validation, which might help bypass the error. However, use this option cautiously as it reduces security.

Please go through these similar threads that might help you:

https://stackoverflow.com/questions/36506539/how-do-i-get-visual-studio-code-to-trust-our-self-signed-proxy-certificate

https://learn.microsoft.com/en-us/answers/questions/1282987/self-signed-certificate-in-certificate-chain-error

Please do "Upvote" if the above suggestion helps. Please do let me know if you have any further concerns. I am happy to address.

Sai, after a significant amount of effort I am leaving this as unresolvable.

I have create, and will share here a script I created to attempt to connect using the certificate and with no avail.

I suspect that the G2 certificate is missing a key OID that the certificate is validating and is missing.

I am bypassing the SSL certificate validation and that is allowing the connection to work.

Here is the script, if you can think of anything else that can be done, it would be appreciated.

    // Verify the certificate chain
    const chain = crypto.createVerify("sha256");
    chain.update(cert.raw);
    const isVerified = chain.verify(rootCerts);

    if (isVerified) {
      console.log("Certificate chain is verified.");
    } else {
      console.log("Certificate chain verification failed.");
    }
  } catch (err) {
    console.error("Error verifying the certificate chain:", err.message);
  }
};

// Function to connect to the database and handle errors
const connectToDatabase = async () => {
  try {
    const client = await pool.connect();
    console.log("Connected to the database successfully");
    client.release();
  } catch (err) {
    console.error("Connection error:", err.message);
    console.error("Error stack:", err.stack);
    if (err.code === "SELF_SIGNED_CERT_IN_CHAIN") {
      console.error("Self-signed certificate in certificate chain detected.");
      console.error(
        "Ensure that the certificate is correctly installed and the path is correct."
      );
    }
  }
};

// Inspect the PEM file
inspectPemFile("DigiCertGlobalRootG2.pem");

// Verify the certificate chain
verifyCertificateChain("DigiCertGlobalRootG2.pem");

// Run the connection function
connectToDatabase();

node .\scripts\Test-PostgreSQLConnectionModule.js
Certificate Details:
Issuer: C=US
O=DigiCert Inc
OU=www.digicert.com
CN=DigiCert Global Root G2
Subject: C=US
O=DigiCert Inc
OU=www.digicert.com
CN=DigiCert Global Root G2
Serial Number: 033AF1E6A711A9A0BB2864B11D09FAE5
Valid From: Aug  1 12:00:00 2013 GMT
Valid To: Jan 15 12:00:00 2038 GMT
Signature Algorithm: undefined
Public Key (PEM):
-----BEGIN PUBLIC KEY-----
...
-----END PUBLIC KEY-----
Fingerprint: DF:3C:24:F9:BF:D6:66:76:1B:26:80:73:FE:06:D1:CC:8D:4F:82:A4
The certificate date is valid and suitable for use.


Connection error: self-signed certificate in certificate chain


**Self-signed certificate in certificate chain detected.**
**Ensure that the certificate is correctly installed and the path is correct.**

Apparently I cannot post the script... odd

Hi Tom Canter,

Could you please try to connect the database by disabling the require_secure_transport = OFF,

By default, secured connectivity between the client and the server is enforced. If you want to disable the enforcement of TLS/SSL, allowing both encrypted and unencrypted client communications, you can change the server parameter require_secure_transport to OFF. You can also set TLS version by setting the ssl_max_protocol_version server parameter.

Kindly let me know if the above explanation was helpful to you