{"record":{"id":"a9b7fa29c75c0166","repo":"jackc/pgx","slug":"unable-to-find-sslpassword","errorCode":null,"errorMessage":"unable to find sslpassword","messagePattern":"unable to find sslpassword","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pgconn/config.go","lineNumber":951,"sourceCode":"\t\t}\n\t\tvar pemKey []byte\n\t\tvar decryptedKey []byte\n\t\tvar decryptedError error\n\t\t// If PEM is encrypted, attempt to decrypt using pass phrase\n\t\tif x509.IsEncryptedPEMBlock(block) {\n\t\t\t// Attempt decryption with pass phrase\n\t\t\t// NOTE: only supports RSA (PKCS#1)\n\t\t\tif sslpassword != \"\" {\n\t\t\t\tdecryptedKey, decryptedError = x509.DecryptPEMBlock(block, []byte(sslpassword)) //nolint:ineffassign\n\t\t\t}\n\t\t\t// if sslpassword not provided or has decryption error when use it\n\t\t\t// try to find sslpassword with callback function\n\t\t\tif sslpassword == \"\" || decryptedError != nil {\n\t\t\t\tif parseConfigOptions.GetSSLPassword != nil {\n\t\t\t\t\tsslpassword = parseConfigOptions.GetSSLPassword(context.Background())\n\t\t\t\t}\n\t\t\t\tif sslpassword == \"\" {\n\t\t\t\t\treturn nil, fmt.Errorf(\"unable to find sslpassword\")\n\t\t\t\t}\n\t\t\t}\n\t\t\tdecryptedKey, decryptedError = x509.DecryptPEMBlock(block, []byte(sslpassword))\n\t\t\t// Should we also provide warning for PKCS#1 needed?\n\t\t\tif decryptedError != nil {\n\t\t\t\treturn nil, fmt.Errorf(\"unable to decrypt key: %w\", decryptedError)\n\t\t\t}\n\n\t\t\tpemBytes := pem.Block{\n\t\t\t\tType:  \"RSA PRIVATE KEY\",\n\t\t\t\tBytes: decryptedKey,\n\t\t\t}\n\t\t\tpemKey = pem.EncodeToMemory(&pemBytes)\n\t\t} else {\n\t\t\tpemKey = pem.EncodeToMemory(block)\n\t\t}\n\t\tcertfile, err := os.ReadFile(sslcert)\n\t\tif err != nil {","sourceCodeStart":933,"sourceCodeEnd":969,"githubUrl":"https://github.com/jackc/pgx/blob/ec1a0befd22592cffffdeeb0a50311b506372f4c/pgconn/config.go#L933-L969","documentation":"The SSL client key is PEM-encrypted but no password could be obtained: sslpassword was not provided and the GetSSLPassword callback either is not set or returned an empty string. Client certificate authentication cannot proceed.","triggerScenarios":"Thrown at pgconn/config.go:951 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Set the sslpassword connection parameter","Provide a ParseConfigWithOptions option with a GetSSLPassword callback","Use an unencrypted key file if security policy allows","Verify the callback returns a non-empty password"],"exampleFix":null,"handlingStrategy":"fallback","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"ec1a0befd22592cffffdeeb0a50311b506372f4c","analyzedAt":"2026-08-04T22:52:11.263Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}