Require users to pass certs when PG environment variable PGSSLMODE is…

… specified

and is either require, verify-ca or verify-full.

packages/pg/lib/connection-parameters.js

@@ -1,6 +1,7 @@
 'use strict'
 
 var dns = require('dns')
+var fs = require('fs')
 
 var defaults = require('./defaults')
 
@@ -23,10 +24,20 @@ var readSSLConfigFromEnvironment = function () {
     case 'disable':
       return false
     case 'prefer':
+      return true
     case 'require':
     case 'verify-ca':
     case 'verify-full':
-      return true
+      if (process.env.PGSSLROOTCERT && process.env.PGSSLKEY && process.env.PGSSLCERT) {
+        return {
+          ca: process.env.PGSSLROOTCERT ? fs.readFileSync(process.env.PGSSLROOTCERT).toString() : undefined,
+          key: process.env.PGSSLKEY ? fs.readFileSync(process.env.PGSSLKEY).toString() : undefined,
+          cert: process.env.PGSSLCERT ? fs.readFileSync(process.env.PGSSLCERT).toString() : undefined,
+        }
+      } else {
+        console.error(`PG Environment Variables PGSSLROOTCERT, PGSSLKEY and PGSSLCERT must be specified when PGSSLMODE=${process.env.PGSSLMODE} is specified`)
+        process.exit(-1)
+      }
     case 'no-verify':
       return { rejectUnauthorized: false }
   }