root certificate file "root.crt" does not exist SSL / TLS Origin: Network Last updated 4 Nov 2026

PostgreSQL: root certificate file "/home/user/.postgresql/root.crt" does not exist. Either provide the file or change sslmode

The connection string asks for certificate verification (sslmode=verify-ca or verify-full) but no CA file was provided.

Exact message you may see root certificate file "root.crt" does not existEither provide the file or change sslmode to disable server certificate verificationpsql: error: root certificate file does not existSSL error: certificate verify failed (sslmode verify-full)
Explore the map of this error Full error map →
Seen on: SSL PostgreSQL Linux

Meaning

Provide the CA with sslrootcert=/path/ca.pem (or PGSSLROOTCERT), or use sslrootcert=system on PostgreSQL 16+ to use the OS store. Managed databases (RDS, Cloud SQL, Azure) publish CA bundles to download. Only lower to sslmode=require if encryption without verification is acceptable.

Common causes

  • sslmode=verify-full without sslrootcert
  • Default ~/.postgresql/root.crt missing
  • Managed DB CA bundle not downloaded
  • Wrong file path in container
  • Connection string from a template with verify-full

⚡ Quick fix

  1. Download the provider's CA bundle and set sslrootcert=/path/bundle.pem
  2. Set PGSSLROOTCERT
  3. Use sslrootcert=system (PG16+) for public-CA servers

Detailed fix by platform

Linux

  1. psql "host=db.example.com dbname=app user=me sslmode=verify-full sslrootcert=/etc/ssl/rds-ca.pem"

How to diagnose

  1. Mode — sslmode value?
  2. File — sslrootcert path?
  3. Provider — CA bundle?

🔧 Still not fixed?

Many errors look alike. If the steps above didn’t solve it, one of these is probably what you’re facing:

Where this error sits

Origin: Network. Errors that are often confused with or caused by this one (click to open):

AH01909: server certificate does NOT include an ID which matches the server name — Apache: [ssl:warn] AH01909: example.com:443:0 server certificate does NOT include an ID which matches the server name (SSL / TLS)AH01909: server certi…CAA record forbids issuance — Let's Encrypt/CA: CAA record for example.com prevents issuance (SSL / TLS)CAA record forbids is…MySQL: SSL connection error: SSL is required but the server doesn't support it — MySQL: ERROR 2026 (HY000): SSL connection error: SSL is required but the server doesn't support it (SSL / TLS)MySQL: SSL connection…sql: database is closed / driver: bad connection — Go: sql: database is closed (Go)sql: database is clos…sql: no rows in result set — Go: sql: no rows in result set (Go)sql: no rows in resul…SSL required — server does not support SSL, but SSL was required / no pg_hba.conf entry … no encryption (PostgreSQL)SSL requiredSSLCertificateFile: file does not exist — Apache: AH02240: Server should be SSL-aware but has no certificate configured / SSLCertificateFile: file '/etc/ssl/x.crt' does not exist or is empty (SSL / TLS)SSLCertificateFile: f…Timeout during connect (likely firewall problem) — Let's Encrypt: Fetching http://example.com/.well-known/acme-challenge/token: Timeout during connect (likely firewall problem) (SSL / TLS)Timeout during connec…root cert…

Explore the map of this error Full error map →

🧠 Still stuck? Analyze your error

Paste the full message, response headers or stack trace — we'll detect the platform and point to the most likely cause.

💬 What worked for others

No tips yet — did something else fix this for you?

Share what worked for you

Tips are checked by an editor before they appear. Links are removed.