9 days ago
The standard Railway PostgreSQL image encrypts connections, but its generated server certificate appears to contain only DNS:localhost. Clients inside Railway connect through the private service DNS name. Is there an officially supported way to obtain a stable client CA and a server certificate whose SAN matches Railway private service DNS so PostgreSQL clients can use sslmode=verify-full? If not currently supported, is this capability planned? No connection strings, credentials, project identifiers, or secrets are included in this question.
1 Replies
9 days ago
This thread has been opened as a bounty so the community can help solve it.
Status changed to Open Railway • 9 days ago
9 days ago
for verify-full to work, the cert needs a SAN that matches the private DNS hostname you're connecting through, right now Railway's cert only has localhost in it so that check will fail. worth confirming that on your end first.
as a workaround i'd suggest verify-ca instead of verify-full, still validates the CA chain so you're not fully unprotected, you just lose the hostname match, and since it's all on railway's private network anyway that's less of a concern than it would be over the public internet.
if you need proper hostname verification, you'd probably have to bring your own cert with the correct SAN and swap it in, worth checking if the postgres image supports overriding the cert files.
can't speak to whether railway's planning to support this natively down the line, that one's for their team