> ## Documentation Index
> Fetch the complete documentation index at: https://cockroachlabs.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Troubleshoot Cloud Setup

export const InternalLink = ({version, path = "", children, ...props}) => {
  let detectedVersion = version || "stable";
  if (typeof window !== 'undefined' && !version) {
    const match = window.location.pathname.match(/\/docs\/([^/]+)/);
    if (match) {
      detectedVersion = match[1];
    }
  }
  const normalizedPath = path.startsWith("/") ? path.slice(1) : path;
  return <a href={`/docs/${detectedVersion}/${normalizedPath}`} {...props}>
      {children}
    </a>;
};

This page describes common CockroachDB Cloud errors and their solutions.

<Danger>
  On June 17, 2021, Cockroach Labs updated the CA certificate used by CockroachDB Basic and Standard clusters. If you downloaded this certificate prior to June 17, 2021, **you must <InternalLink path="connect-to-your-cluster#connect-to-your-cluster">download the updated certificate</InternalLink> by September 30, 2021** to avoid disruptions to your service.
</Danger>

## Connection errors

### Cannot load certificates

You see the following error when you are using the <InternalLink version="stable" path="cockroach-sql">`cockroach sql`</InternalLink> command to connect to your CockroachDB Standard or Basic cluster:

```text theme={"theme":{"light":"catppuccin-mocha","dark":"catppuccin-mocha"}}
ERROR: cannot load certificates.
Check your certificate settings, set --certs-dir, or use --insecure for insecure clusters.

problem using security settings: no certificates found; does certs dir exist?
Failed running "sql"
```

#### Solution

Update to the latest <InternalLink version="releases" path="index">CockroachDB client</InternalLink>. You need to use v21.2.5 or later of the CockroachDB client to connect to your cluster without specifying the CA certificate path in the connection string.

### Certificate signed by unknown authority

The following error is displayed when trying to connect to a cluster:

```text theme={"theme":{"light":"catppuccin-mocha","dark":"catppuccin-mocha"}}
Error: x509: certificate signed by unknown authority
Failed running "sql"
```

#### Solution: CA certificate conflicts

If you have existing certificates in `~" path=".cockroach-certs` used to connect to CockroachDB self-hosted or CockroachDB Advanced clusters and are trying to connect to a CockroachDB Standard or Basic cluster using <InternalLink version="stable" path="cockroach-sql">`cockroach sql`</InternalLink>, you need to download the CA cert by running the command from the **Cluster Overview** > **Connect** dialog if you have not already done so, and then set the `sslrootcert` parameter in the connection string you use when running `cockroach sql`.

For example, on Linux and Mac, set the `sslrootcert` parameter to `$HOME/.postgresql/root.crt` in the connection string:

```shell theme={"theme":{"light":"catppuccin-mocha","dark":"catppuccin-mocha"}}
cockroach sql --url "postgresql://maxroach@blue-dog-147.6wr.cockroachlabs.cloud:26257/defaultdb?sslmode=verify-full&sslrootcert=$HOME/.postgresql/root.crt"
```

### Invalid cluster name in a third-party tool

The following error is displayed if you try to connect to a <InternalLink version="stable" path="third-party-database-tools">third-party tool</InternalLink> with the wrong cluster or database name. The actual error message may vary depending on your tool:

```text theme={"theme":{"light":"catppuccin-mocha","dark":"catppuccin-mocha"}}
FATAL: CodeParamsRoutingFailed: rejected by BackendConfigFromParams: Invalid cluster name
```

#### Solution

Check that you are using the correct cluster and database names. You can find these parameters in the CockroachDB Cloud Console by navigating to **Cluster Overview** > **Connect** > **Step 2. Connect** > **Connection parameters**.

For connection examples with your tool, see <InternalLink version="stable" path="third-party-database-tools">these examples</InternalLink>.

### I/O timeout

The following error is most often caused by trying to connect to a cluster without <InternalLink path="connect-to-your-cluster#authorize-your-network">authorizing the right network</InternalLink>, not having an internet connection, or an issue in your application environment:

```text theme={"theme":{"light":"catppuccin-mocha","dark":"catppuccin-mocha"}}
Is the server running?
If the server is running, check --host client-side and --advertise server-side.

dial tcp 35.196.33.161:26257: i/o timeout
Failed running "sql"
```

#### Solution

Check if you have internet access.

If you do have internet access, check if you have <InternalLink path="connect-to-your-cluster#authorize-your-network">authorized the right network</InternalLink>:

* In a development environment, you need to authorize your application server’s network and your local machine’s network. If you change your location, you need to authorize the new location’s network, or else the connection from that network will be rejected.
* In a production environment, you need to authorize your application server’s network.
* An `i/o timeout` can also be caused by firewall rules, which require your network administrator to investigate.

If neither of the above steps succeed, investigate your application's timeout value and environment:

* Increase the timeout value (e.g., from 5 seconds to 30 seconds) for your application's driver or framework and see if connection succeeds.
* If you can connect and run the same query in the SQL CLI, investigate your application environment.
* Investigate your network infrastructure to see if there is a network related performance problem, or [contact support](https://support.cockroachlabs.com/) with these details.

### No such host

The following error is displayed when you supply an incorrect host name:

```text theme={"theme":{"light":"catppuccin-mocha","dark":"catppuccin-mocha"}}
ERROR: cannot dial server.
Is the server running?
If the server is running, check --host client-side and --advertise server-side.

dial tcp: lookup gcp-us-east4.crdb.io: no such host
Failed running "sql"
```

#### Solution

Check if you are using the correct host name.

You can find your host name in the CockroachDB Cloud Console by navigating to **Cluster Overview** > **Connect** > **Step 2. Connect** > **Connection parameters** and locating the **Host** field. If the error persists, [contact Support](https://support.cockroachlabs.com/).

### Connection refused

The following error is displayed if your cluster connection is dropped:

```text theme={"theme":{"light":"catppuccin-mocha","dark":"catppuccin-mocha"}}
Error: dial tcp 35.240.101.1:26257: connect: connection refused
```

#### Solution

CockroachDB Cloud connections can occasionally become invalid due to upgrades, restarts, or other disruptions. Your application should use a <InternalLink version="stable" path="connection-pooling">pool of persistent connections</InternalLink> and <InternalLink path="production-checklist#sql-connection-handling">mitigate connection disruptions</InternalLink> to ensure that connections remain current. See the <InternalLink path="production-checklist">Production Checklist</InternalLink> for more information.

## Security errors

### Incorrect certs path

The following error is displayed if the directory path for the CA certificate is incorrect:

```text theme={"theme":{"light":"catppuccin-mocha","dark":"catppuccin-mocha"}}
Error: open test-cluster-ca.crt: no such file or directory
Failed running "sql"
```

#### Solution

Check the directory path for the <InternalLink path="connect-to-your-cluster#connect-to-your-cluster">CA certificate in the connection method</InternalLink>. If you have downloaded multiple CA certificates, check that you are using the right one.

### Issue with CockroachDB workloads

The following error is displayed while trying to a run <InternalLink version="stable" path="cockroach-workload">CockroachDB workload</InternalLink> with `sslmode=verify-full`:

```text theme={"theme":{"light":"catppuccin-mocha","dark":"catppuccin-mocha"}}
Error: x509: certificate signed by unknown authority
```

#### Solution

This is a known issue. Use `sslmode=require` instead.

<Note>
  Using `sslmode=require` can leave your cluster vulnerable to MITM and impersonation attacks. For more information, see PostgreSQL's [SSL Support](https://www.postgresql.org/docs/9.4/libpq-ssl) document.
</Note>

## CockroachDB Basic and Standard

### Delayed cluster access

To enhance security, CockroachDB Basic and Standard clusters use authentication throttling tracked per proxy and per (client IP, cluster) pair. This means if multiple login attempts fail on the same client to the same cluster (for example, due to repeated incorrect passwords or brute force attacks), access is temporarily delayed, with the wait time increasing after each attempt (up to an hour).

#### Solution

If you are experiencing access issues, ensure that the password is correct. If the problem persists, [contact support](https://support.cockroachlabs.com/).

### Hanging or stuck queries

A hanging or stuck query using a CockroachDB Basic or Standard cluster may be caused by reaching the cluster's configured <InternalLink path="plan-your-cluster-basic#choose-resource-limits">resource limits</InternalLink> for <InternalLink path="plan-your-cluster-basic#request-units">Request Units</InternalLink> or storage space. SQL Statements and `cockroach` CLI commands may be impacted. You can check your cluster's resource limits and status from the <InternalLink version="cockroachcloud" path="overview-page">**Overview** page</InternalLink> in the Cloud Console. Resource limits are displayed in **Usage this month**. If you've used all your storage, your cluster will be labeled **THROTTLED**, and you will be limited to a single SQL connection which you can use to delete data. If you've used all your RUs, your cluster will be **DISABLED**.

#### Solution

If you've reached your storage or RU limit, you can <InternalLink path="basic-cluster-management#edit-cluster-capacity">increase your resource limits</InternalLink> and then re-run the query.

If you've only reached your RU limit, you can wait until the next billing cycle when <InternalLink path="plan-your-cluster-basic#free-vs-paid-usage">monthly free RUs</InternalLink> become available and then re-run the query.