How to fix P1011: Error opening a TLS connection in Prisma

Development vs Production SSL Configuration

In development, you might be tempted to disable SSL verification entirely. While trustServerCertificate=true (SQL Server) or sslmode=disable (PostgreSQL) will work, avoid committing these settings to production configuration. Instead, use environment-specific connection strings.

SSH Tunnels and TLS

If you're connecting through an SSH tunnel, the TLS connection happens inside the tunnel. Some users report P1011 errors when Prisma attempts direct TLS while the tunnel already provides encryption. In these cases, you may need to use sslmode=disable or sslmode=prefer for the connection string, since the SSH tunnel itself provides the security layer.

Certificate Authority Updates

AWS RDS periodically updates certificate authorities. If you're using an older RDS CA certificate (like rds-ca-2019), and AWS has rotated to newer CAs (like rds-ca-ecc384-g1), you may encounter P1011 errors. Always use the latest certificate bundle from your provider.

Prisma CLI vs Generated Client

There's a known difference between how the Prisma CLI and the generated client handle certificates:
- Prisma CLI: Can use sslcert= parameter or sslrootcert= if OS trusts the certificate
- Generated client with adapters (like @prisma/adapter-pg): Must use sslrootcert= parameter

If you see different behavior between npx prisma migrate and your application runtime, check that both are using compatible SSL parameters.

Security Warning

Never use sslaccept=accept_invalid_certs in production. This parameter disables all certificate validation and makes your connection vulnerable to man-in-the-middle attacks. Only use it temporarily in development to diagnose issues, then implement proper certificate validation.