cube-js/cube · error · Error

${envKey} is not a valid SSL ${name}. If it's a path, please

Error message

${envKey} is not a valid SSL ${name}. If it's a path, please specify it correctly

What it means

Validation in BaseDriver.getSslOptions: an SSL credential environment variable (e.g. CUBEJS_DB_SSL_CA/CERT/KEY, per its `envKey`) contains a value that is neither a valid PEM certificate body nor a path to a readable file containing one. Fires while building driver SSL options from environment configuration.

Source

Thrown at packages/cubejs-base-driver/src/BaseDriver.ts:272

                throw new Error(
                  `Unable to find ${name} from path: "${value}"`,
                );
              }

              const file = fs.readFileSync(value, 'utf8');
              if (validate(file)) {
                return {
                  ...agg,
                  ...{ [name]: file }
                };
              }

              throw new Error(
                `Content of the file from ${envKey} is not a valid SSL ${name}.`,
              );
            }

            throw new Error(
              `${envKey} is not a valid SSL ${name}. If it's a path, please specify it correctly`,
            );
          }

          return agg;
        },
        {}
      );

      ssl.rejectUnauthorized = getEnv('dbSslRejectUnauthorized', { dataSource, preAggregations });

      return ssl;
    }

    return undefined;
  }

  public abstract testConnection(): Promise<void>;

View on GitHub (pinned to 7d981676b3)

Solutions

1. Set the env variable to a valid file path pointing to the PEM file, or inline the full PEM content.
2. Verify the file exists and is readable by the Cube process (see the companion 'Unable to find ... from path' / 'not a valid SSL' errors).
3. Check for truncated or wrongly concatenated certificate content in the environment value.

Example fix

// before
CUBEJS_DB_SSL_CERT=true
// after
CUBEJS_DB_SSL_CERT=/etc/ssl/certs/client.pem

function assertSslOpt(v?: string) {
  if (!v) return;
  const looksLikePath = v.startsWith('/') || v.startsWith('./');
  if (looksLikePath && !fs.existsSync(v)) throw new Error(`SSL path invalid: ${v}`);
  if (!looksLikePath && !v.includes('-----BEGIN')) throw new Error('SSL value is neither PEM nor path');
}

try { await driver.testConnection(); } catch (e) { if (/is not a valid SSL/.test(e.message)) console.error('Set the SSL env var to PEM content or an existing file path'); throw e; }

When it happens

Trigger: An SSL option (e.g. CUBEJS_DB_SSL_KEY) is set to arbitrary text that is neither PEM nor an existing file path, or a path with typos/unsupported characters.

Common situations: Setting env vars to placeholder values like 'true', mistyped paths, or passing a URL instead of a local file path.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• Value "${input}" is not valid for ${envName}. ${description}
• Value "${input}" is not valid for ${envName}. Should be a po
• Value "${input}" is not valid for ${envName}. Should be lowe
• The ${dataSource} data source is missing in the declared CUB
• The ${keyByDataSource('CUBEJS_DB_SSL', dataSource)} must be

AI-assisted analysis of cube-js/cube@7d981676b3 (2026-09-02). Data as JSON: /api/errors/f09bcb3ef5e3e6e1. Report an issue: GitHub.