n8n · Help

n8n and Supabase: certificate chain rejected?

Postgres connection fails with a certificate-chain error? Check the endpoint, trust chain and the differences between Cloud and self-hosting.

Source date: 5 November 2026Editorial team: KAN KAI WORKSEditorially updated:

Quick answer

The error self-signed certificate in certificate chain points to a certificate-chain verification problem. Connecting while ignoring SSL issues does not establish verified server identity. First compare the actual Supabase endpoint, port and connection mode, then inspect its issuer, intermediate certificates and hostname coverage. For n8n Cloud, establish the supported configuration route; instructions for adding a CA to your own container do not imply an equivalent Cloud feature.

Source basis: Q1 · Q2 · Q3

Applies to
The reported case concerns n8n Cloud and Supabase Postgres. Custom CA configuration is separately documented for self-hosting; the available Cloud settings require confirmation.
How to verify the result
The intended database connection succeeds with the required certificate and hostname checks active, and its endpoint, trust source and responsible configuration are documented.
Your first check

Which database endpoint and certificate checks does your connection use?

n8n cannot connect to your Supabase Postgres database and reports `self-signed certificate in certificate chain`. Disabling certificate checks appears to make the connection work. That observation narrows the investigation, but it does not establish a suitable long-term configuration for confidential data.

n8n cannot connect to your Supabase Postgres database and reports self-signed certificate in certificate chain. Disabling certificate checks appears to make the connection work. That observation narrows the investigation, but it does not establish a suitable long-term configuration for confidential data.

What is established and what remains uncertain

A public report describes this behaviour on n8n Cloud, where the user could not find an input for a custom CA file. Q1 n8n documents SSL settings and the option to ignore certificate issues for Postgres credentials. It separately documents custom certificate authorities for self-hosted installations. Q2 Q3 This does not establish that the same import mechanism is available in every Cloud environment.

The error also does not prove that the database intentionally uses an insecure certificate. An incomplete chain, an unexpected endpoint or a missing trusted issuer are different possibilities that need separate verification.

Checks that lead to a decision

  1. Identify the endpoint. Compare hostname, port, connection mode and database user with the settings actually supplied for your project. Direct connections and poolers are different destinations. Switching ports does not install a missing trust chain.
  2. Preserve the exact error. Record the n8n version, Cloud or container environment, and selected SSL options. Do not publish passwords or complete connection strings in screenshots.
  3. Inspect the chain for that hostname. Ask the database operator or administrator to compare issuer, intermediate certificates, validity and hostname coverage. A successful test against another database address does not verify the original one.
  4. Establish Cloud support. If the credential interface has no CA setting, ask n8n support for the supported approach for this specific database connection. A container configuration guide does not create an equivalent feature in a Cloud account.
  5. For self-hosting, add only the intended trust. Obtain the verified public CA certificate from a trusted source and use the mechanism documented for your installed version. Retest with certificate checks enabled. Private keys do not belong in a CA certificate directory.

What a completed repair should demonstrate

A successful connection test confirms basic function. Also establish that the intended certificate and hostname checks are active. Encryption and verified peer identity are separate properties. Document the supported configuration and who maintains it so that replacing a container does not silently remove the fix.

Frequently asked questions

Can I leave “Ignore SSL issues” enabled?

That bypasses the check which produced the error. Do not treat the resulting connection as evidence of verified identity. Resolve the trust-chain question instead.

What information is useful for assistance?

Supply product versions, hosting type, anonymised endpoint type, exact error and SSL configuration. The CA issuer and expiry date may help. Publishing login credentials is unnecessary.

Help with this case

We can help isolate the affected process and prepare a controlled next step. Discuss case A0065 with KAN KAI WORKS.

Support with this issue

We investigate n8n using your error message, versions and a narrowly scoped example.

Describe your case →Related service: AI & automation

Sources

Sources checked on 5 November 2026. Individual reports do not establish general prevalence.