How can I fix the 'self-signed certificate in certificate chain' error when connecting n8n to a Supabase database?

Below are a few suggestions to resolve the “self‑signed certificate in certificate chain” error when connecting your Supabase database:

1. Verify Your SSL Settings in n8n

Even though you mentioned SSL is not enabled, Supabase by default requires SSL. In the PostgreSQL credential configuration in n8n, you have these options:

• SSL Mode:
  • If you’re not planning to use SSL validation you can toggle on the "Ignore SSL Issues" option. This skips certificate trust verification (though it’s less secure).
  • Otherwise, set the SSL option to “Require” so that n8n uses SSL for the connection.

2. Use Only the CA Certificate

If you want to verify the connection securely:

• Download the Supabase CA certificate from your project’s API settings.
• In the credential settings, enter the certificate (or its filepath within the container) into the SSL CA field.
• Do not provide a key or client certificate; these fields are only needed for mutual TLS (client certificate authentication) and are not required by Supabase. Leave the SSL Key field empty.

3. Mounting Your Custom CA Certificate (if using a custom domain)

Since you are also using a custom Namecheap domain, your instance might be using a certificate not recognized by n8n’s default CA store. In that case, you can configure n8n to trust your custom certificate by mounting it into the container. For example, using Docker:

BASHCopied
docker run -it --rm \
  --name n8n \
  -p 5678:5678 \
  -v /path/to/your/certs:/opt/custom-certificates \
  docker.n8n.io/n8nio/n8n

After the container is running, ensure that the permissions on the mounted certificate are set correctly:

BASHCopied
docker exec --user 0 n8n chown -R 1000:1000 /opt/custom-certificates

This allows n8n to use your certificate authority for validating TLS connections instead of the default set.

4. Summary of Steps

• Option A (Disabling Validation):
  Use the “Ignore SSL Issues” toggle in the PostgreSQL node credentials if you’re comfortable with skipping certificate validation.

• Option B (Secure Connection):
  • Set SSL mode to “Require”.
  • Supply the Supabase or your custom CA certificate in the SSL CA field (make sure it’s accessible by the container or specified by the environment variable).
  • Leave the SSL Key field empty if you don’t use client certificate authentication.

Give one of these a try based on your security needs. Adjusting the SSL settings should resolve the certificate chain issues without requiring an SSL key you don’t possess.

Let me know if you need further clarification on any of these steps!