property

SQL.TLSOptions.checkServerIdentity

checkServerIdentity?: (hostname: string, cert: PeerCertificate) => undefined | Error

Replaces the built-in check of the host name against the server's certificate, as in node:tls. To keep that check, call checkServerIdentity() from node:tls inside the function.

Bun calls it once for each connection, after the certificate chain verified and before it sends the user name or the password. Like ca, it raises an SSL mode below "verify-ca" to "verify-full". Bun does not call it with rejectUnauthorized: false.

const sql = new SQL(url, {
  tls: {
    ca: Bun.file("./ca.pem"),
    checkServerIdentity: (hostname, cert) =>
      cert.fingerprint256 === pin ? undefined : new Error("certificate pin mismatch"),
  },
});