cube-js/cube · error · Error

Content of the file from ${envKey} is not a valid SSL ${name

Error message

Content of the file from ${envKey} is not a valid SSL ${name}.

What it means

When an SSL option points to an existing file (via env var), getSslOptions() reads it and validates the content (e.g. checks it is a PEM cert/key). If the file content fails validation, this error is thrown.

Source

Thrown at packages/cubejs-base-driver/src/BaseDriver.ts:267

              };
            }

            if (canBeFile && isFilePath(value)) {
              if (!fs.existsSync(value)) {
                throw new Error(
                  `Unable to find ${name} from path: "${value}"`,
                );
              }

              const file = fs.readFileSync(value, 'utf8');
              if (validate(file)) {
                return {
                  ...agg,
                  ...{ [name]: file }
                };
              }

              throw new Error(
                `Content of the file from ${envKey} is not a valid SSL ${name}.`,
              );
            }

            throw new Error(
              `${envKey} is not a valid SSL ${name}. If it's a path, please specify it correctly`,
            );
          }

          return agg;
        },
        {}
      );

      ssl.rejectUnauthorized = getEnv('dbSslRejectUnauthorized', { dataSource, preAggregations });

      return ssl;
    }

View on GitHub (pinned to 7d981676b3)

Solutions

Inspect the file content and confirm it is valid PEM for the expected type (CERTIFICATE / PRIVATE KEY)
Re-export or re-download the certificate in PEM format
Check you pointed the env var at the correct file (cert vs key vs CA)
Use an inline value instead of a file path to bypass file reading

Example fix

// before
CUBEJS_DB_SSL_CA=/downloads/ca.crt   // file is actually JSON error output
// after
CUBEJS_DB_SSL_CA=/etc/ssl/rootCA.pem // valid PEM content

Defensive patterns

Strategy: validation

Validate before calling

const content = fs.readFileSync(envVal, 'utf8');
if (!content.includes('-----BEGIN') || !content.includes('-----END')) throw new Error(`Invalid PEM in ${envKey}`);

Try / catch

try { await cubeServer(); } catch (e) { if (/not a valid SSL/.test(e.message)) console.error('Fix the SSL file content referenced by env var'); throw e; }

Prevention

Validate PEM files (openssl x509 -in f.pem -noout) before wiring them in
Keep cert/key/CA files in a dedicated, versioned location
Never pipe command output directly into cert files without checking it
Distinguish cert, key, and CA files by naming convention

When it happens

Trigger: The env var (e.g. CUBEJS_DB_SSL_CERT) points to an existing file whose contents do not pass the SSL validator (not valid PEM, wrong format, empty, HTML error page).

Common situations: Downloading a cert and saving an error page, copying the wrong file (e.g. the CSR instead of the cert), truncated base64, Windows line-ending corruption, or pointing at a bundle in the wrong format.

Understand the failure class

SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

AI-assisted analysis of cube-js/cube@7d981676b3 (2026-09-02). Data as JSON: /api/errors/66251c5c5417a9e7. Report an issue: GitHub.