Cert fails in type-orm but works fine with node-postgres - amazon-iam

Question

I want to connect to a Postgres data source using type-orm like this:
it("can connect using type-orm", async () => {
const signer = new AWS.RDS.Signer({
region: REGION,
hostname: DB_INSTANCE,
port: DB_PORT,
username: DB_USER
})
const AppDataSource = new DataSource({
type: "postgres",
host: DB_HOST,
port: DB_PORT,
username: DB_USER,
password: async () => signer.getAuthToken({}),
database: DB_DATABASE,
entities: [],
synchronize: false,
logging: false,
ssl: {
ca: fs.readFileSync('./cert.pem').toString(),
},
})
await AppDataSource.initialize()
});
But it fails with:
Hostname/IP does not match certificate's altnames: Host: localhost. is not in the cert's altnames: DNS: <TRUE AWS altnames here>
What is interesting is that the exact same credentials/certificate works fine with node-postgres:
it("can connect using node-postgres", async () => {
const signer = new AWS.RDS.Signer({
region: REGION,
hostname: DB_INSTANCE,
port: DB_PORT,
username: DB_USER
})
const client = new Client({
user: DB_USER,
host: DB_HOST,
database: DB_DATABASE,
password: signer.getAuthToken({}),
port: DB_PORT,
ssl: {
ca: fs.readFileSync('./cert.pem').toString(),
},
});
await client.connect();
await client.end();
})
So the certificate should be fine? I'm connecting to localhost:5432 which output a forwarded port on a jump server.

Answer 1

It seems type-orm performs a stricter validation. To bypass it, I added rejectUnauthorized in the extra option:
it("can connect using type-orm", async () => {
const AppDataSource = new DataSource({
type: "postgres",
host: env.DB_HOST,
port: env.DB_PORT,
username: env.DB_USER,
password: 'password123',
database: env.DB_DATABASE,
entities: [],
synchronize: false,
logging: false,
ssl: {
ca: fs.readFileSync('./cert.pem').toString(),
},
extra: {
ssl: {
// Disregard mismatch between localhost and rds.amazonaws.com
rejectUnauthorized: false
}
}
})
await AppDataSource.initialize()
});