How to fix P1011: Error opening a TLS connection in Prisma

First, examine your DATABASE_URL in your .env file or environment variables:

# Check your connection string
echo $DATABASE_URL

Look for SSL/TLS related parameters. Note that Prisma uses provider-specific parameter names:
- PostgreSQL: sslmode, sslcert, sslrootcert
- SQL Server: encrypt, trustServerCertificate
- MySQL: sslaccept, sslca, sslcert, sslidentity, sslpassword

A common mistake with MySQL is reusing PostgreSQL-style names like sslmode or ssl-ca/ssl-cert — Prisma's MySQL connector does not recognize these and will ignore or reject them. The absence or misconfiguration of these parameters is often the root cause.

If you're using SQL Server with a self-signed certificate or in a development environment, add trustServerCertificate=true:

# .env
DATABASE_URL="sqlserver://localhost:1433;database=mydb;trustServerCertificate=true;encrypt=true"

For Azure SQL Database with properly signed certificates:

DATABASE_URL="sqlserver://myserver.database.windows.net:1433;database=mydb;trustServerCertificate=false;encrypt=true"

Note: Only use trustServerCertificate=true when you trust the server or are in development. In production with proper certificates, use false.

PostgreSQL requires explicit SSL mode configuration. Update your connection string with the appropriate sslmode:

# .env - For databases that support SSL but don't require it
DATABASE_URL="postgresql://user:password@localhost:5432/mydb?sslmode=prefer"

# For databases that require SSL (like many cloud providers)
DATABASE_URL="postgresql://user:password@localhost:5432/mydb?sslmode=require"

# For databases requiring certificate verification
DATABASE_URL="postgresql://user:password@localhost:5432/mydb?sslmode=verify-ca&sslrootcert=./ca-certificate.crt"

Available sslmode values (from least to most secure):
- disable: No SSL
- prefer: Try SSL, fall back to non-SSL
- require: Require SSL but don't verify certificates
- verify-ca: Require SSL and verify CA
- verify-full: Require SSL and verify hostname

Prefer verify-full (or at least verify-ca) in production so the certificate chain and hostname are validated.

Prisma's MySQL connector uses a different parameter set than PostgreSQL. To enable verified TLS, point sslca at your CA certificate and request a strict acceptance level:

# .env - Require a valid, CA-verified certificate (recommended)
DATABASE_URL="mysql://user:password@host:3306/mydb?sslaccept=strict&sslca=./ca-cert.pem"

For mutual TLS where the server requires a client certificate, also provide sslcert and the client key/identity:

DATABASE_URL="mysql://user:password@host:3306/mydb?sslaccept=strict&sslca=./ca-cert.pem&sslcert=./client-cert.pem&sslidentity=./client-identity.p12&sslpassword=changeit"

Key MySQL parameters:
- sslaccept: strict (verify the certificate, recommended) or accept_invalid_certs (no verification — see the security warning below)
- sslca: path to the trusted CA certificate
- sslcert: path to the client certificate (for mutual TLS)
- sslidentity / sslpassword: PKCS#12 client identity file and its password

There is no sslmode, ssl-ca, or ssl-cert for the Prisma MySQL connector — use the names above.

For cloud database providers that require certificate verification, download the certificate bundle:

AWS RDS/Aurora:

# Download RDS certificate bundle
curl -o rds-ca-bundle.pem https://truststore.pki.rds.amazonaws.com/global/global-bundle.pem

# Update connection string
DATABASE_URL="postgresql://user:[email protected]:5432/dbname?sslmode=verify-full&sslrootcert=./rds-ca-bundle.pem"

Google Cloud SQL:

# Download server-ca.pem from the Cloud SQL instance via the Console or:
#   gcloud sql ssl server-ca-certs list --instance=INSTANCE_NAME
# Then reference it in your connection string
DATABASE_URL="postgresql://user:password@host:5432/db?sslmode=verify-ca&sslrootcert=./server-ca.pem"

Use an absolute path (or one resolved relative to the process working directory) rather than a literal ~, which is not expanded inside connection-string parameters. Ensure the certificate file is accessible to your application at runtime.

After updating your connection string, test the connection:

# Test database connection (read-only introspection)
npx prisma db pull

# Or run a migration to verify in a development database
npx prisma migrate dev --name test_connection

If the CLI command succeeds, your TLS configuration is correct. If you still see P1011, review the error details for specific TLS failure reasons. (db pull --force overwrites your schema.prisma, so omit --force unless you intend to regenerate it.)

Some P1011 errors have been resolved in newer Prisma versions. Check your version and upgrade if needed:

# Check current version
npx prisma --version

# Update Prisma dependencies
npm install @prisma/client@latest prisma@latest

# Regenerate Prisma Client
npx prisma generate

After upgrading, test your connection again. Some certificate authority and TLS protocol compatibility issues have been fixed in recent releases.