Is it safe to set rejectUnauthorized to false when using Heroku's Postgres database?

Question

I am trying to put some fields in a Postgres database hosted on a Heroku app and it keeps returning this error:

Error: self signed certificate code: 'DEPTH_ZERO_SELF_SIGNED_CERT' 

I have tried adding a key, certificate, and CA bundle but to no avail

Many StackOverflow questions with the same error say to set the variable rejectUnauthorized to false when making the http server. My question is how safe is this with a Postgres database on Heroku and would it pose any threat to the security of the database?

If the information helps I am using a node.js script to send the query to the database.

Answer 1

Heroku does not support client-side certificate validation to its Postgres databases unless you are using Private Spaces or Shield:

Unless you're using a Private or Shield Heroku Postgres database, Heroku Postgres does not currently support verifiable certificates.

My understanding is that in this case, the best you can do is:

• Your connection is encrypted and you are protected from eavesdropping
• Not protected against Man-In-The-Middle (MITM) attacks

ssl: { sslmode: 'require', rejectUnauthorized: false, } 

This is the highest level without certificate validation, according to the table here: