cube-js/cube · error · PostgresError

Please use CUBEJS_DB_SSL=true to connect: ${(e as Error).toS

Error message

Please use CUBEJS_DB_SSL=true to connect: ${(e as Error).toString()}

What it means

During testConnection, if the test query fails with 'no pg_hba.conf entry for host', PostgresDriver rethrows a PostgresError advising to enable SSL (CUBEJS_DB_SSL=true). This pg_hba message typically means the server rejects the connection because the client is not using SSL where the host-based auth rules demand it.

Source

Thrown at packages/cubejs-postgres-driver/src/PostgresDriver.ts:285

      return NativeTypeToPostgresType[dataTypeID].toLowerCase();
    }

    if (this.userDefinedTypes && dataTypeID in this.userDefinedTypes) {
      return this.userDefinedTypes[dataTypeID].toLowerCase();
    }

    return null;
  }

  public async testConnection(): Promise<void> {
    // eslint-disable-next-line no-underscore-dangle
    const conn: PgClient = await this.pool._factory.create();

    try {
      await conn.query('SELECT $1::int AS number', ['1']);
    } catch (e) {
      if ((e as Error).toString().indexOf('no pg_hba.conf entry for host') !== -1) {
        throw new PostgresError(`Please use CUBEJS_DB_SSL=true to connect: ${(e as Error).toString()}`, { cause: e as Error });
      }

      throw e;
    } finally {
      // eslint-disable-next-line no-underscore-dangle
      await this.pool._factory.destroy(conn);
    }
  }

  protected async loadUserDefinedTypes(conn: PgClient): Promise<void> {
    if (!this.userDefinedTypes) {
      // Postgres enum types defined as typcategory = 'E' these can be assumed
      // to be of type varchar for the drivers purposes.
      // Postgres array types defined as typcategory = 'A' these can be assumed
      // to be of type text for the drivers purposes.
      // TODO: if full implmentation the constraints can be looked up via pg_enum
      // https://www.postgresql.org/docs/9.1/catalog-pg-enum.html
      //

View on GitHub (pinned to 7d981676b3)

Solutions

1. Set CUBEJS_DB_SSL=true (or the driver's ssl option) so the client negotiates TLS.
2. If using a self-signed certificate, additionally allow/accept the CA (rejectUnauthorized settings as appropriate).
3. Alternatively add a pg_hba.conf entry permitting non-SSL connections from the client host (not recommended).
4. Confirm with the DBA which host-ssl rules apply to your source IP.

Example fix

// before
new PostgresDriver({ host: 'ec2-...-compute.amazonaws.com', database: 'db', user: 'u', password: 'p' });
// after
new PostgresDriver({ host: 'ec2-...-compute.amazonaws.com', database: 'db', user: 'u', password: 'p', ssl: true });

try {
  await driver.testConnection();
} catch (e) {
  if (e.message.includes('CUBEJS_DB_SSL=true')) {
    console.error('Server requires SSL; enable ssl in driver config or set CUBEJS_DB_SSL=true');
  }
  throw e;
}

When it happens

Trigger: Calling `testConnection()` against a Postgres server whose pg_hba.conf requires SSL for the client's host/IP, while the driver connects without SSL.

Common situations: Connecting to cloud Postgres (Heroku, RDS with sslmode enforcement, Azure, Supabase) without TLS enabled; self-hosted Postgres with `hostssl` rules; containerized Cube talking to an SSL-only endpoint.

Related errors

• The ${keyByDataSource('CUBEJS_DB_SSL', dataSource)} must be
• The ${keyByDataSource('CUBEJS_DB_SSL_REJECT_UNAUTHORIZED', d
• Unable to find ${name} from path: "${value}"
• Content of the file from ${envKey} is not a valid SSL ${name
• ${envKey} is not a valid SSL ${name}. If it's a path, please

AI-assisted analysis of cube-js/cube@7d981676b3 (2026-09-02). Data as JSON: /api/errors/2a9d4870dca5c8c0. Report an issue: GitHub.