pathwaycom/pathway · error · ValueError

sslrootcert is not readable: {e}

Error message

sslrootcert is not readable: {e}

What it means

Raised by the postgres connector's _build_tls_settings when the sslrootcert file exists but cannot be opened due to an OSError other than 'is a directory' or 'not found' — in practice almost always a permissions problem. The original OS error text is appended.

Source

Thrown at python/pathway/io/postgres/__init__.py:242

    owned_settings["replication"] = "database"
    query = "&".join(f"{enc(k)}={enc(v)}" for (k, v) in owned_settings.items())

    return f"postgresql://{userinfo}{hostport}{path}?{query}"


def _build_tls_settings(owned_postgres_settings: dict) -> TLSSettings:
    sslmode = owned_postgres_settings.pop("sslmode", "prefer")

    sslrootcert = owned_postgres_settings.pop("sslrootcert", None)
    if sslrootcert is not None:
        try:
            open(sslrootcert).close()
        except IsADirectoryError as e:
            raise ValueError("sslrootcert doesn't point to a file") from e
        except FileNotFoundError as e:
            raise ValueError("sslrootcert points to a non-existent path") from e
        except OSError as e:
            raise ValueError(f"sslrootcert is not readable: {e}") from e

    return TLSSettings(mode=sslmode, root_cert_path=sslrootcert)


def _construct_replication_settings(
    *,
    mode: Literal["streaming", "static"],
    postgres_settings: dict,
    publication_name: str | None,
    replication_slot_name: str | None,
    snapshot_name: str | None,
):
    # static mode doesn't require replication slots
    if mode == "static":
        if publication_name is not None:
            raise ValueError("'publication_name' is not needed for the static mode")
        if replication_slot_name is not None:
            raise ValueError(

View on GitHub (pinned to fa2f74a464)

Solutions

1. Grant read access: chmod 644 /path/ca.pem (or chown to the service user).
2. Ensure every directory in the path is traversable (chmod +x on parents).
3. If SELinux is enforcing, restore the correct context: restorecon -v /path/ca.pem.

Example fix

# shell
# before: ls -l /etc/pathway/root.pem -> -rw------- root root
sudo chmod 644 /etc/pathway/root.pem
# after: pipeline can open the file

import os
p = postgres_settings.get("sslrootcert")
if p is not None:
    with open(p, "rb") as f:  # raises early with the OS error if unreadable
        pass

try:
    pw.io.postgres.write(t, parts, "tbl", postgres_settings=pg_settings)
except ValueError as e:
    if "sslrootcert is not readable" in str(e):
        logging.error("fix permissions on %s", pg_settings["sslrootcert"])
        raise

When it happens

Trigger: The process user lacks read permission on the CA file (mode 600 owned by root, pipeline runs as non-root); SELinux/AppArmor denying access; path component with no execute (traverse) permission.

Common situations: Secrets mounted as root-only files in Kubernetes; files copied with restrictive umask; systemd services running as a dedicated user.

Related errors

• sslrootcert doesn't point to a file
• sslrootcert points to a non-existent path
• Failed to install dependencies
• Column {api.TIME_PSEUDOCOLUMN} cannot contain negative times
• Column {api.DIFF_PSEUDOCOLUMN} can only have 1 and -1 values

AI-assisted analysis of pathwaycom/pathway@fa2f74a464 (2026-08-15). Data as JSON: /api/errors/40420920f372e953. Report an issue: GitHub.