PlanetScale "connection requires TLS" (sslaccept) in CI
PlanetScale accepts only TLS-encrypted MySQL connections. A client that connects without SSL, or with a CA it cannot verify, is refused. The direct connection string must carry sslaccept=strict or the driver must be told to use TLS.
What this error means
A MySQL client fails with "connections using insecure transport are prohibited" or an SSL handshake error against a PlanetScale host, while a pscale-connect proxy connection works.
ERROR 3159 (HY000): Connections using insecure transport are prohibited while
--require_secure_transport=ON.Common causes
The client connected without TLS
A driver that defaults SSL off, or a DSN missing the SSL parameter, sends an insecure connection that PlanetScale rejects.
The CA bundle is not available to verify the server
Strict TLS needs a trusted CA. A slim runner image without system CA certificates cannot verify the PlanetScale certificate.
How to fix it
Require TLS in the connection string
- Add
sslaccept=strict(or the driver equivalent) to the DSN. - Ensure system CA certificates are present so verification succeeds.
- Prefer the direct TLS connection over the local proxy in cloud CI where possible.
DATABASE_URL="mysql://user:pass@aws.connect.psdb.cloud/app?sslaccept=strict"Install CA certificates on the runner
When strict verification fails, refresh the trust store so the PlanetScale certificate validates.
sudo apt-get update && sudo apt-get install -y ca-certificatesHow to prevent it
- Keep sslaccept=strict (or equivalent) in every PlanetScale DSN.
- Ensure ca-certificates is installed on custom runner images.
- Do not disable TLS to work around a verification error.