{"record":{"id":"33870cebaeec239a","repo":"jackc/pgx","slug":"unable-to-read-sslkey-w","errorCode":null,"errorMessage":"unable to read sslkey: %w","messagePattern":"unable to read sslkey: %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pgconn/config.go","lineNumber":928,"sourceCode":"\t\t\t\topts.Intermediates.AddCert(cert)\n\t\t\t}\n\t\t\t_, err := certs[0].Verify(opts)\n\t\t\treturn err\n\t\t}\n\tcase \"verify-full\":\n\t\ttlsConfig.ServerName = host\n\tdefault:\n\t\treturn nil, errors.New(\"sslmode is invalid\")\n\t}\n\n\tif (sslcert != \"\" && sslkey == \"\") || (sslcert == \"\" && sslkey != \"\") {\n\t\treturn nil, errors.New(`both \"sslcert\" and \"sslkey\" are required`)\n\t}\n\n\tif sslcert != \"\" && sslkey != \"\" {\n\t\tbuf, err := os.ReadFile(sslkey)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"unable to read sslkey: %w\", err)\n\t\t}\n\t\tblock, _ := pem.Decode(buf)\n\t\tif block == nil {\n\t\t\treturn nil, errors.New(\"failed to decode sslkey\")\n\t\t}\n\t\tvar pemKey []byte\n\t\tvar decryptedKey []byte\n\t\tvar decryptedError error\n\t\t// If PEM is encrypted, attempt to decrypt using pass phrase\n\t\tif x509.IsEncryptedPEMBlock(block) {\n\t\t\t// Attempt decryption with pass phrase\n\t\t\t// NOTE: only supports RSA (PKCS#1)\n\t\t\tif sslpassword != \"\" {\n\t\t\t\tdecryptedKey, decryptedError = x509.DecryptPEMBlock(block, []byte(sslpassword)) //nolint:ineffassign\n\t\t\t}\n\t\t\t// if sslpassword not provided or has decryption error when use it\n\t\t\t// try to find sslpassword with callback function\n\t\t\tif sslpassword == \"\" || decryptedError != nil {","sourceCodeStart":910,"sourceCodeEnd":946,"githubUrl":"https://github.com/jackc/pgx/blob/ec1a0befd22592cffffdeeb0a50311b506372f4c/pgconn/config.go#L910-L946","documentation":"The SSL client key file (sslkey) could not be read from disk. The wrapped error is the file read error, usually a missing file or wrong permissions. Note that PostgreSQL also requires the key file to have 0600 permissions.","triggerScenarios":"Thrown at pgconn/config.go:928 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Verify the sslkey path is correct","Check file permissions (should be readable by the client, ideally 0600)","Confirm the file exists on the client machine","Ensure both sslcert and sslkey are set together"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"ec1a0befd22592cffffdeeb0a50311b506372f4c","analyzedAt":"2026-08-04T22:52:11.263Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}