{"record":{"id":"2a9d4870dca5c8c0","repo":"cube-js/cube","slug":"please-use-cubejs-db-ssl-true-to-connect-e-as","errorCode":null,"errorMessage":"Please use CUBEJS_DB_SSL=true to connect: ${(e as Error).toString()}","messagePattern":"Please use CUBEJS_DB_SSL=true to connect: (.+?)","errorType":"exception","errorClass":"PostgresError","httpStatus":null,"severity":"error","filePath":"packages/cubejs-postgres-driver/src/PostgresDriver.ts","lineNumber":285,"sourceCode":"      return NativeTypeToPostgresType[dataTypeID].toLowerCase();\n    }\n\n    if (this.userDefinedTypes && dataTypeID in this.userDefinedTypes) {\n      return this.userDefinedTypes[dataTypeID].toLowerCase();\n    }\n\n    return null;\n  }\n\n  public async testConnection(): Promise<void> {\n    // eslint-disable-next-line no-underscore-dangle\n    const conn: PgClient = await this.pool._factory.create();\n\n    try {\n      await conn.query('SELECT $1::int AS number', ['1']);\n    } catch (e) {\n      if ((e as Error).toString().indexOf('no pg_hba.conf entry for host') !== -1) {\n        throw new PostgresError(`Please use CUBEJS_DB_SSL=true to connect: ${(e as Error).toString()}`, { cause: e as Error });\n      }\n\n      throw e;\n    } finally {\n      // eslint-disable-next-line no-underscore-dangle\n      await this.pool._factory.destroy(conn);\n    }\n  }\n\n  protected async loadUserDefinedTypes(conn: PgClient): Promise<void> {\n    if (!this.userDefinedTypes) {\n      // Postgres enum types defined as typcategory = 'E' these can be assumed\n      // to be of type varchar for the drivers purposes.\n      // Postgres array types defined as typcategory = 'A' these can be assumed\n      // to be of type text for the drivers purposes.\n      // TODO: if full implmentation the constraints can be looked up via pg_enum\n      // https://www.postgresql.org/docs/9.1/catalog-pg-enum.html\n      //","sourceCodeStart":267,"sourceCodeEnd":303,"githubUrl":"https://github.com/cube-js/cube/blob/7d981676b36392fec34088b9afab6bdcad40207c/packages/cubejs-postgres-driver/src/PostgresDriver.ts#L267-L303","documentation":"During testConnection, if the test query fails with 'no pg_hba.conf entry for host', PostgresDriver rethrows a PostgresError advising to enable SSL (CUBEJS_DB_SSL=true). This pg_hba message typically means the server rejects the connection because the client is not using SSL where the host-based auth rules demand it.","triggerScenarios":"Calling `testConnection()` against a Postgres server whose pg_hba.conf requires SSL for the client's host/IP, while the driver connects without SSL.","commonSituations":"Connecting to cloud Postgres (Heroku, RDS with sslmode enforcement, Azure, Supabase) without TLS enabled; self-hosted Postgres with `hostssl` rules; containerized Cube talking to an SSL-only endpoint.","solutions":["Set CUBEJS_DB_SSL=true (or the driver's ssl option) so the client negotiates TLS.","If using a self-signed certificate, additionally allow/accept the CA (rejectUnauthorized settings as appropriate).","Alternatively add a pg_hba.conf entry permitting non-SSL connections from the client host (not recommended).","Confirm with the DBA which host-ssl rules apply to your source IP."],"exampleFix":"// before\nnew PostgresDriver({ host: 'ec2-...-compute.amazonaws.com', database: 'db', user: 'u', password: 'p' });\n// after\nnew PostgresDriver({ host: 'ec2-...-compute.amazonaws.com', database: 'db', user: 'u', password: 'p', ssl: true });","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n  await driver.testConnection();\n} catch (e) {\n  if (e.message.includes('CUBEJS_DB_SSL=true')) {\n    console.error('Server requires SSL; enable ssl in driver config or set CUBEJS_DB_SSL=true');\n  }\n  throw e;\n}","preventionTips":["Default to ssl: true for managed/cloud Postgres providers.","Check pg_hba.conf rules (hostssl entries) for your source IP.","Include connection tests in health checks so this surfaces at startup.","Provision proper CA certificates instead of disabling TLS."],"tags":["postgres","ssl","pg-hba","configuration"],"backgroundTag":"ssl-required","analyzedSha":"7d981676b36392fec34088b9afab6bdcad40207c","analyzedAt":"2026-09-02T03:45:10.400Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}