{"record":{"id":"4a81db396a24de81","repo":"cube-js/cube","slug":"the-keybydatasource-cubejs-db-ssl-reject-unauth","errorCode":null,"errorMessage":"The ${keyByDataSource('CUBEJS_DB_SSL_REJECT_UNAUTHORIZED', dataSource)} must be either 'true' or 'false'.","messagePattern":"The (.+?) must be either 'true' or 'false'\\.","errorType":"validation","errorClass":"TypeError","httpStatus":null,"severity":"error","filePath":"packages/cubejs-backend-shared/src/env.ts","lineNumber":432,"sourceCode":"        } must be either 'true' or 'false'.`\n      );\n    }\n  },\n\n  /**\n   * Reject unauthorized SSL connection flag.\n   */\n  dbSslRejectUnauthorized: ({\n    dataSource,\n    preAggregations,\n  }: DataSourceOpts) => {\n    const val = get(keyByDataSource('CUBEJS_DB_SSL_REJECT_UNAUTHORIZED', dataSource, preAggregations)).default('false').asString();\n    if (val.toLocaleLowerCase() === 'true') {\n      return true;\n    } else if (val.toLowerCase() === 'false') {\n      return false;\n    } else {\n      throw new TypeError(\n        `The ${\n          keyByDataSource('CUBEJS_DB_SSL_REJECT_UNAUTHORIZED', dataSource)\n        } must be either 'true' or 'false'.`\n      );\n    }\n  },\n\n  /**\n   * Database URL.\n   */\n  dbUrl: ({\n    dataSource,\n    preAggregations,\n  }: DataSourceOpts) => (\n    get(keyByDataSource('CUBEJS_DB_URL', dataSource, preAggregations)).asString()\n  ),\n\n  /**","sourceCodeStart":414,"sourceCodeEnd":450,"githubUrl":"https://github.com/cube-js/cube/blob/7d981676b36392fec34088b9afab6bdcad40207c/packages/cubejs-backend-shared/src/env.ts#L414-L450","documentation":"CUBEJS_DB_SSL_REJECT_UNAUTHORIZED controls whether TLS certificates are validated, and Cube accepts only 'true' or 'false' (case-insensitive); other values throw a TypeError naming the data-source-specific variable. This mirrors the Node.js tls option of the same name.","triggerScenarios":"Setting CUBEJS_DB_SSL_REJECT_UNAUTHORIZED (or CUBEJS_DS_<DS>_SSL_REJECT_UNAUTHORIZED) to '1', '0', 'yes', 'no', or a value polluted by quotes/newlines from shell or secret-manager quoting.","commonSituations":"Trying to disable cert validation for self-signed certs using 0 instead of false; secrets manager adding surrounding quotes; Docker compose quoting quirks producing '\"false\"'.","solutions":["Set the variable to exactly true or false.","Use false (not 0) when disabling certificate rejection, and prefer fixing trust chains over disabling validation.","Echo the value via node -p \"JSON.stringify(process.env.X)\" to catch stray quotes/whitespace.","Fix your deployment templating (Helm/envsubst) so it doesn't wrap booleans in quotes."],"exampleFix":"// before\nCUBEJS_DB_SSL_REJECT_UNAUTHORIZED=0\n// after\nCUBEJS_DB_SSL_REJECT_UNAUTHORIZED=false","handlingStrategy":"validation","validationCode":"const v = process.env.CUBEJS_DB_SSL_REJECT_UNAUTHORIZED;\nif (v !== undefined && !/^(true|false)$/i.test(v.trim()))\n  throw new Error(`CUBEJS_DB_SSL_REJECT_UNAUTHORIZED must be 'true' or 'false', got: ${JSON.stringify(v)}`);","typeGuard":"function isSslRejectBool(v: unknown): v is 'true' | 'false' {\n  return typeof v === 'string' && /^(true|false)$/i.test(v.trim());\n}","tryCatchPattern":"try {\n  sslRejectUnauthorized(dataSource);\n} catch (e) {\n  if (e instanceof TypeError && e.message.includes('SSL_REJECT_UNAUTHORIZED')) {\n    console.error('Use exactly true or false; disable cert rejection only with a fixed trust chain');\n  }\n  throw e;\n}","preventionTips":["Use false (not 0) when bypassing cert validation, and prefer adding the CA to the trust store.","Strip quotes in deployment templates that wrap boolean env values.","Validate all *_SSL_* env vars in a startup smoke test."],"tags":["configuration","ssl","tls","environment-variables","typeerror"],"backgroundTag":"invalid-boolean-env-var","analyzedSha":"7d981676b36392fec34088b9afab6bdcad40207c","analyzedAt":"2026-09-02T03:45:10.400Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}