apache/superset · error · ValidationError

Invalid certificate

Error message

Invalid certificate

What it means

server_cert_validator runs on the server certificate field of database create/update: when a non-empty value is supplied, parse_ssl_cert attempts to load it as a PEM certificate and a CertificateException becomes ValidationError('Invalid certificate'). The stored cert is later used to verify the database TLS connection.

Source

Thrown at superset/databases/schemas.py:238

            ]
        ) from ex
    if current_app.config.get("PREVENT_UNSAFE_DB_CONNECTIONS", True):
        try:
            check_sqlalchemy_uri(uri)
        except SupersetSecurityException as ex:
            raise ValidationError([str(ex)]) from ex
    return value


def server_cert_validator(value: str) -> str:
    """
    Validate the server certificate
    """
    if value:
        try:
            parse_ssl_cert(value)
        except CertificateException as ex:
            raise ValidationError([_("Invalid certificate")]) from ex
    return value


def encrypted_extra_validator(value: str | None) -> None:
    """
    Validate that encrypted extra is a valid JSON string
    """
    if value:
        try:
            json.loads(value)
        except json.JSONDecodeError as ex:
            raise ValidationError(
                [_("Field cannot be decoded by JSON. %(msg)s", msg=str(ex))]
            ) from ex


def masked_encrypted_extra_validator(value: str) -> None:
    """

View on GitHub (pinned to f4587218dd)

Solutions

1. Provide the PEM-encoded certificate including the -----BEGIN CERTIFICATE----- / -----END CERTIFICATE----- lines.
2. Convert DER to PEM: openssl x509 -inform der -in cert.cer -out cert.pem.
3. Verify locally: openssl x509 -in cert.pem -noout (must succeed).
4. Leave the field empty if the connection does not require a pinned server cert.

Example fix

# before
server_cert: "MIIDdzCCAl+gAwIBAgIEAgAAuTANBg"  # bare base64 blob

# after
server_cert: "-----BEGIN CERTIFICATE-----\nMIIDdzCCAl+gAwIBAgIEAgAAuTANBg...\n-----END CERTIFICATE-----\n"

import ssl

def is_pem_cert(pem: str) -> bool:
    try:
        ssl.PEM_cert_to_DER_cert(pem)
        return True
    except (ValueError, TypeError):
        return False

When it happens

Trigger: POST/PUT /api/v1/database/ with server_cert containing anything that is not a parseable PEM certificate: a public key only, a CA bundle in DER (binary) form, a cert with mangled base64, or text pasted with missing BEGIN/END lines.

Common situations: Pasting the TLS server's public key instead of the certificate; copying from a terminal that dropped the header/footer; uploading DER instead of PEM; concatenation with stray blank characters inside base64 blocks.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• Field is required
• Database not found.
• Database not found.
• Database parameters are invalid.
• Database not found

AI-assisted analysis of apache/superset@f4587218dd (2026-08-14). Data as JSON: /api/errors/606014c176de9ab1. Report an issue: GitHub.