unrecognized configuration parameter "sslrootcert"

[igalklebanov]

Hey 👋

It was reported on Discord that PostgreSQL connection strings with the sslrootcert=<path> query parameter result in unrecognized configuration parameter "sslrootcert" errors.

This query parameter is not a Prisma ORM-specific query parameter and should be supported in PostgreSQL since at least version 8.4 which is almost 20 years old.

[sorenbs]

Thanks for the report!

Initial investigation:

This does not look like an @prisma/studio-core bug. In this repo, createPostgresAdapter (line 49) only consumes an executor, and createPostgresJSExecutor (line 21) only wraps an already-created postgres client. Studio core never parses the raw PostgreSQL URL here. I started the demo with pnpm demo:ppg and verified in Playwright on March 24, 2026 that http://localhost:4310 boots normally; the only browser error was a missing favicon.ico.

The likely owner is Prisma CLI in prisma/prisma, not this repo. There is a close precedent: the "schema" startup-parameter bug was reported on November 19, 2025 and fixed on November 24, 2025 in Prisma CLI by stripping ORM-specific query params before constructing the postgres.js client. Current CLI code still does not handle sslrootcert, and postgres@3.4.8 only special-cases sslrootcert=system; it does not map file paths to TLS ca options. My inference is that the sslrootcert= failure is happening in the CLI connection bootstrap path that feeds postgres.js, not inside studio-core.

The next fix surface should be prisma/prisma/packages/cli/src/Studio.ts. Stripping sslrootcert would be wrong because it drops certificate validation; the correct fix is to translate libpq-style SSL params like sslrootcert (and likely sslcert / sslkey) into postgres() SSL options before creating the client.

[sorenbs]

Hey @igalklebanov 👋 Fixed in #1551. postgres.js forwards unrecognized URL query params to the server as runtime parameters, which is where the error came from. There's now a connection-config helper on the data/postgresjs entrypoint that consumes the libpq SSL params (sslrootcert, sslcert, sslkey, sslpassword, sslmode) into proper TLS options and strips them from the URL. One follow-up: the CLI in prisma/prisma needs to adopt the helper so prisma studio users get the fix — we'll take care of wiring that up.