How to Get Rid of a Self-Signed Certificate (EdgeDB)

Hi there,

As far as I can see from the docs here:

https://docs.edgedb.com/database/reference/environment

You can start the edgedb-server process with the --tls-cert-file and --tls-key-file flags so that you can point it to the correct Let’s Encrypt SSL files.

Basically first make sure that your Let’s Encrypt certificates are correctly installed and accessible on your Droplet:

ls -l /etc/letsencrypt/live/yourdomain.com/

Make sure that the EdgeDB service user has the necessary permissions to read the certificate and key files. You might need to adjust permissions or add the EdgeDB user to a group that has read access to the Let’s Encrypt files.

sudo chown root:edgedb /etc/letsencrypt/live/yourdomain.com/*
sudo chmod 750 /etc/letsencrypt/live/yourdomain.com/
sudo chmod 640 /etc/letsencrypt/live/yourdomain.com/*

And then if the files are there with the correct permissions. Then you need to configure EdgeDB to use your Let’s Encrypt certificate instead of the self-signed certificate, if you’re starting EdgeDB manually, you can use command-line arguments like this:

edgedb-server --tls-cert-file=/etc/letsencrypt/live/yourdomain.com/fullchain.pem --tls-key-file=/etc/letsencrypt/live/yourdomain.com/privkey.pem

If EdgeDB is set up as a service, you might need to edit its service configuration file, usually located in /etc/systemd/system/ or /lib/systemd/system/:

[Unit]
Description=EdgeDB Server
After=network.target

[Service]
User=edgedb
Group=edgedb
ExecStart=/usr/bin/edgedb-server --tls-cert-file=/etc/letsencrypt/live/yourdomain.com/fullchain.pem --tls-key-file=/etc/letsencrypt/live/yourdomain.com/privkey.pem

[Install]
WantedBy=multi-user.target

After modifying the configuration, reload the systemd manager configuration and restart the EdgeDB service:

sudo systemctl daemon-reload
sudo systemctl restart edgedb-server

Feel free to share how the service was setup exactly and I will be happy to look into it further.

Best,

Bobby