Skip to content

Document connecting to a local database without TLS #20

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
openai0229 merged 1 commit into from
Sep 20, 2026
Merged

Document connecting to a local database without TLS #20

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 9 additions & 1 deletion README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -197,7 +197,15 @@ sqlx datasource test --id dev
sqlx sql execute --datasource dev --sql "SELECT current_database()" --sql "SELECT 1"
```

For an agent or script, provide credentials through environment variables or a connection JSON object on stdin, as described below. TLS verifies the database certificate by default; use `--tls disable` only for a connection explicitly intended to be unencrypted.
MySQL, Oracle, and SQL Server work the same way with `--type mysql --port 3306`, `--type oracle --service <service-name>`, and `--type sqlserver --port 1433`. A database running in a local container usually does not serve a certificate your machine trusts, and `verify-full` fails there with `invalid peer certificate: UnknownIssuer` (MySQL), `error performing TLS handshake` (PostgreSQL), or a closed connection (Oracle). Create or update that connection with `--tls disable`:

```sh
sqlx datasource add --name dev --type mysql --host 127.0.0.1 --port 3306 --database app \
--username-env DB_USER --password-env DB_PASSWORD --tls disable
sqlx datasource update --id dev --tls disable
```

For an agent or script, provide credentials through environment variables or a connection JSON object on stdin, as described below. TLS verifies the database certificate by default; disable it only for a connection that does not serve a certificate you trust. When a connection fails before any statement, the error message repeats that the transport can be disabled.

## Commands

Expand Down
Loading