Problem invoking `ctk settings compare`

[amotl]

Hi. @goat-ssh just reported this:

hello, any hints what am i missing in ctk settings compare authentication?

export CRATEDB_CLUSTER_URL="crate://crate@localhost:4201"

(.venv) ➜  cratedb-toolkit git:(main) ctk settings compare
[26/02/18| 5:12PM]
Comparing settings in crate://crate@localhost:4201 against default settings
2026-02-18 17:12:13,072 [cratedb_toolkit.docs.settings       ] INFO    : Extracting CrateDB settings from https://cratedb.com/docs/crate/reference/en/latest/config/cluster.html
⠙ Fetching documentation
⠙ Processing tables...
⠙ Processing definition lists...
⠙ Processing section headers...
⠙ Identifying runtime configurable settings...
2026-02-18 17:12:14,009 [cratedb_toolkit.docs.settings       ] INFO    : Extracted 83 settings in total
2026-02-18 17:12:14,009 [cratedb_toolkit.docs.settings       ] INFO    : Found 55 runtime configurable settings
2026-02-18 17:12:14,010 [cratedb_toolkit.docs.settings       ] INFO    : Generated 55 SQL statements for runtime configurable settings
2026-02-18 17:12:15,188 [crate.client.http                   ] WARNING : Removed server http://localhost:4201/ from active pool

Traceback (most recent call last):
  File "/Users/shyukri/.local/share/uv/tools/cratedb-toolkit/lib/python3.13/site-packages/urllib3/connectionpool.py", line 787, in urlopen
    response = self._make_request(
        conn,
    ...<10 lines>...
        **response_kw,
    )
  File "/Users/shyukri/.local/share/uv/tools/cratedb-toolkit/lib/python3.13/site-packages/urllib3/connectionpool.py", line 534, in _make_request

On the other hand, crash connects just fine:

crash -U crate --hosts https://localhost:4201/ --verify-ssl false

[amotl]

@WalBeh shared this successful invocation example to confirm it works. Does it help?

Comparing settings in crate://crate@localhost:4200/?sslmode=require against default settings
2026-02-18 16:51:55,607 [cratedb_toolkit.docs.settings       ] INFO    : Extracting CrateDB settings from https://cratedb.com/docs/crate/reference/en/latest/config/cluster.html
⠦ Fetching documentation
⠦ Processing tables...
⠦ Processing definition lists...
⠦ Processing section headers...
⠦ Identifying runtime configurable settings...
2026-02-18 16:51:56,943 [cratedb_toolkit.docs.settings       ] INFO    : Extracted 83 settings in total
2026-02-18 16:51:56,943 [cratedb_toolkit.docs.settings       ] INFO    : Found 55 runtime configurable settings
2026-02-18 16:51:56,946 [cratedb_toolkit.docs.settings       ] INFO    : Generated 55 SQL statements for runtime configurable settings
Heap Size: 7_516_192_768 bytes

=== Non-default CrateDB settings ===
(Using 2.9% tolerance for settings > 20.0% of heap, 1.0% for smaller settings)
Default settings loaded

CLUSTER
=======
cluster.routing.allocation.cluster_concurrent_rebalance: 6 (default: 2)
  SET GLOBAL PERSISTENT "cluster.routing.allocation.cluster_concurrent_rebalance" = 2
cluster.routing.allocation.node_concurrent_recoveries: 12 (default: 2)
  SET GLOBAL PERSISTENT "cluster.routing.allocation.node_concurrent_recoveries" = 2
cluster.routing.allocation.node_initial_primaries_recoveries: 6 (default: 4)
  SET GLOBAL PERSISTENT "cluster.routing.allocation.node_initial_primaries_recoveries" = 4

GATEWAY
=======
gateway.expected_data_nodes: 3 (default: -1)
gateway.recover_after_data_nodes: 2 (default: -1)
gateway.recover_after_time: 0ms (default: 5m)

INDICES
=======
indices.recovery.max_bytes_per_sec: 200mb (default: 40mb)
  SET GLOBAL PERSISTENT "indices.recovery.max_bytes_per_sec" = '40mb'

OVERLOAD_PROTECTION
===================
overload_protection.dml.max_concurrency: 5 (default: 100)
  SET GLOBAL PERSISTENT "overload_protection.dml.max_concurrency" = 100


Total non-default settings: 8

[amotl]

shared this successful invocation example to confirm it works. Does it help?

Comparing settings in crate://crate@localhost:4200/?sslmode=require against default settings

@goat-ssh: It is possibly the ?sslmode=require parameter you are missing? With CRATEDB_CLUSTER_URL, you may need to use ?ssl=true instead. Please let us know how this goes.

export CRATEDB_CLUSTER_URL="crate://crate@localhost:4201?ssl=true"

[amotl]

@WalBeh confirmed this incantation works for him. Thanks!

uv tool install --upgrade cratedb-toolkit
ctk settings compare --cluster-url "crate://crate@localhost:4200/?sslmode=require"

[amotl]

@goat-ssh: In your OP, there is a Traceback preamble, but it is lacking the corresponding Exception, usually located at the end. Can you share the full output?

[goat-ssh]

Still no luck, tried with ssl=true and ssl=false:

ssl=false

ctk settings compare --cluster-url "crate://crate@localhost:4200/?ssl=false"                                                                                             [26/02/18| 6:24PM]
Comparing settings in crate://crate@localhost:4200/?ssl=false against default settings
2026-02-18 18:24:52,049 [cratedb_toolkit.docs.settings       ] INFO    : Extracting CrateDB settings from https://cratedb.com/docs/crate/reference/en/latest/config/cluster.html
⠹ Fetching documentation
⠹ Processing tables...
⠹ Processing definition lists...
⠹ Processing section headers...
⠹ Identifying runtime configurable settings...
2026-02-18 18:24:53,052 [cratedb_toolkit.docs.settings       ] INFO    : Extracted 83 settings in total
2026-02-18 18:24:53,052 [cratedb_toolkit.docs.settings       ] INFO    : Found 55 runtime configurable settings
2026-02-18 18:24:53,054 [cratedb_toolkit.docs.settings       ] INFO    : Generated 55 SQL statements for runtime configurable settings
2026-02-18 18:24:54,198 [crate.client.http                   ] WARNING : Removed server http://localhost:4200 from active pool
Traceback (most recent call last):
  File "/Users/shyukri/.local/share/uv/tools/cratedb-toolkit/lib/python3.13/site-packages/urllib3/connectionpool.py", line 787, in urlopen
    response = self._make_request(
        conn,
    ...<10 lines>...
        **response_kw,
    )
  File "/Users/shyukri/.local/share/uv/tools/cratedb-toolkit/lib/python3.13/site-packages/urllib3/connectionpool.py", line 534, in _make_request
    response = conn.getresponse()
  File "/Users/shyukri/.local/share/uv/tools/cratedb-toolkit/lib/python3.13/site-packages/urllib3/connection.py", line 571, in getresponse
    httplib_response = super().getresponse()
  File "/Users/shyukri/.local/share/uv/python/cpython-3.13.5-macos-aarch64-none/lib/python3.13/http/client.py", line 1430, in getresponse
    response.begin()
    ~~~~~~~~~~~~~~^^
  File "/Users/shyukri/.local/share/uv/python/cpython-3.13.5-macos-aarch64-none/lib/python3.13/http/client.py", line 331, in begin
    version, status, reason = self._read_status()
                              ~~~~~~~~~~~~~~~~~^^
  File "/Users/shyukri/.local/share/uv/python/cpython-3.13.5-macos-aarch64-none/lib/python3.13/http/client.py", line 300, in _read_status
    raise RemoteDisconnected("Remote end closed connection without"
                             " response")
http.client.RemoteDisconnected: Remote end closed connection without response

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/Users/shyukri/.local/share/uv/tools/cratedb-toolkit/lib/python3.13/site-packages/crate/client/http.py", line 587, in _request
    response = self.server_pool[next_server].request(
        method,
    ...<5 lines>...
        **kwargs,
    )
  File "/Users/shyukri/.local/share/uv/tools/cratedb-toolkit/lib/python3.13/site-packages/crate/client/http.py", line 196, in request
    return self.pool.urlopen(
           ~~~~~~~~~~~~~~~~~^
        method,
        ^^^^^^^
    ...<4 lines>...
        **kwargs,
        ^^^^^^^^^
    )
    ^
  File "/Users/shyukri/.local/share/uv/tools/cratedb-toolkit/lib/python3.13/site-packages/urllib3/connectionpool.py", line 841, in urlopen
    retries = retries.increment(
        method, url, error=new_e, _pool=self, _stacktrace=sys.exc_info()[2]
    )
  File "/Users/shyukri/.local/share/uv/tools/cratedb-toolkit/lib/python3.13/site-packages/urllib3/util/retry.py", line 490, in increment
    raise reraise(type(error), error, _stacktrace)
          ~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/Users/shyukri/.local/share/uv/tools/cratedb-toolkit/lib/python3.13/site-packages/urllib3/util/util.py", line 38, in reraise
    raise value.with_traceback(tb)
  File "/Users/shyukri/.local/share/uv/tools/cratedb-toolkit/lib/python3.13/site-packages/urllib3/connectionpool.py", line 787, in urlopen
    response = self._make_request(
        conn,
    ...<10 lines>...
        **response_kw,
    )
  File "/Users/shyukri/.local/share/uv/tools/cratedb-toolkit/lib/python3.13/site-packages/urllib3/connectionpool.py", line 534, in _make_request
    response = conn.getresponse()
  File "/Users/shyukri/.local/share/uv/tools/cratedb-toolkit/lib/python3.13/site-packages/urllib3/connection.py", line 571, in getresponse
    httplib_response = super().getresponse()
  File "/Users/shyukri/.local/share/uv/python/cpython-3.13.5-macos-aarch64-none/lib/python3.13/http/client.py", line 1430, in getresponse
    response.begin()
    ~~~~~~~~~~~~~~^^
  File "/Users/shyukri/.local/share/uv/python/cpython-3.13.5-macos-aarch64-none/lib/python3.13/http/client.py", line 331, in begin
    version, status, reason = self._read_status()
                              ~~~~~~~~~~~~~~~~~^^
  File "/Users/shyukri/.local/share/uv/python/cpython-3.13.5-macos-aarch64-none/lib/python3.13/http/client.py", line 300, in _read_status
    raise RemoteDisconnected("Remote end closed connection without"
                             " response")
urllib3.exceptions.ProtocolError: ('Connection aborted.', RemoteDisconnected('Remote end closed connection without response'))

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/Users/shyukri/.local/share/uv/tools/cratedb-toolkit/lib/python3.13/site-packages/sqlalchemy/engine/base.py", line 1967, in _exec_single_context
    self.dialect.do_execute(
    ~~~~~~~~~~~~~~~~~~~~~~~^
        cursor, str_statement, effective_parameters, context
        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
    )
    ^
  File "/Users/shyukri/.local/share/uv/tools/cratedb-toolkit/lib/python3.13/site-packages/sqlalchemy_cratedb/dialect.py", line 240, in do_execute
    result = cursor.execute(statement, parameters)
  File "/Users/shyukri/.local/share/uv/tools/cratedb-toolkit/lib/python3.13/site-packages/crate/client/cursor.py", line 57, in execute
    self._result = self.connection.client.sql(
                   ~~~~~~~~~~~~~~~~~~~~~~~~~~^
        sql, parameters, bulk_parameters
        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
    )
    ^
  File "/Users/shyukri/.local/share/uv/tools/cratedb-toolkit/lib/python3.13/site-packages/crate/client/http.py", line 508, in sql
    content = self._json_request("POST", self.path, data=data)
  File "/Users/shyukri/.local/share/uv/tools/cratedb-toolkit/lib/python3.13/site-packages/crate/client/http.py", line 639, in _json_request
    response = self._request(method, path, data=data)
  File "/Users/shyukri/.local/share/uv/tools/cratedb-toolkit/lib/python3.13/site-packages/crate/client/http.py", line 630, in _request
    self._drop_server(next_server, ex_message)
    ~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/Users/shyukri/.local/share/uv/tools/cratedb-toolkit/lib/python3.13/site-packages/crate/client/http.py", line 700, in _drop_server
    raise ConnectionError(
    ...<2 lines>...
    )
crate.client.exceptions.ConnectionError: No more Servers available, exception from last server: ('Connection aborted.', RemoteDisconnected('Remote end closed connection without response'))

The above exception was the direct cause of the following exception:

Traceback (most recent call last):
  File "/Users/shyukri/.local/bin/ctk", line 10, in <module>
    sys.exit(cli())
             ~~~^^
  File "/Users/shyukri/.local/share/uv/tools/cratedb-toolkit/lib/python3.13/site-packages/click/core.py", line 1161, in __call__
    return self.main(*args, **kwargs)
           ~~~~~~~~~^^^^^^^^^^^^^^^^^
  File "/Users/shyukri/.local/share/uv/tools/cratedb-toolkit/lib/python3.13/site-packages/click/core.py", line 1082, in main
    rv = self.invoke(ctx)
  File "/Users/shyukri/.local/share/uv/tools/cratedb-toolkit/lib/python3.13/site-packages/click/core.py", line 1697, in invoke
    return _process_result(sub_ctx.command.invoke(sub_ctx))
                           ~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^
  File "/Users/shyukri/.local/share/uv/tools/cratedb-toolkit/lib/python3.13/site-packages/click/core.py", line 1697, in invoke
    return _process_result(sub_ctx.command.invoke(sub_ctx))
                           ~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^
  File "/Users/shyukri/.local/share/uv/tools/cratedb-toolkit/lib/python3.13/site-packages/click/core.py", line 1443, in invoke
    return ctx.invoke(self.callback, **ctx.params)
           ~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/Users/shyukri/.local/share/uv/tools/cratedb-toolkit/lib/python3.13/site-packages/click/core.py", line 788, in invoke
    return __callback(*args, **kwargs)
  File "/Users/shyukri/.local/share/uv/tools/cratedb-toolkit/lib/python3.13/site-packages/cratedb_toolkit/settings/compare.py", line 378, in compare_cluster_settings
    heap_size_bytes = adapter.get_heap_size()
  File "/Users/shyukri/.local/share/uv/tools/cratedb-toolkit/lib/python3.13/site-packages/cratedb_toolkit/util/database.py", line 250, in get_heap_size
    rows = self.run_sql("SELECT heap['max'] AS heap_size FROM sys.nodes LIMIT 1", records=True)
  File "/Users/shyukri/.local/share/uv/tools/cratedb-toolkit/lib/python3.13/site-packages/cratedb_toolkit/util/database.py", line 131, in run_sql
    return self.run_sql_real(sql=sql_effective, parameters=parameters, records=records)
           ~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/Users/shyukri/.local/share/uv/tools/cratedb-toolkit/lib/python3.13/site-packages/cratedb_toolkit/util/database.py", line 150, in run_sql_real
    result = self.connection.execute(sa.text(statement), parameters)
  File "/Users/shyukri/.local/share/uv/tools/cratedb-toolkit/lib/python3.13/site-packages/sqlalchemy/engine/base.py", line 1419, in execute
    return meth(
        self,
        distilled_parameters,
        execution_options or NO_OPTIONS,
    )
  File "/Users/shyukri/.local/share/uv/tools/cratedb-toolkit/lib/python3.13/site-packages/sqlalchemy/sql/elements.py", line 527, in _execute_on_connection
    return connection._execute_clauseelement(
           ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^
        self, distilled_params, execution_options
        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
    )
    ^
  File "/Users/shyukri/.local/share/uv/tools/cratedb-toolkit/lib/python3.13/site-packages/sqlalchemy/engine/base.py", line 1641, in _execute_clauseelement
    ret = self._execute_context(
        dialect,
    ...<8 lines>...
        cache_hit=cache_hit,
    )
  File "/Users/shyukri/.local/share/uv/tools/cratedb-toolkit/lib/python3.13/site-packages/sqlalchemy/engine/base.py", line 1846, in _execute_context
    return self._exec_single_context(
           ~~~~~~~~~~~~~~~~~~~~~~~~~^
        dialect, context, statement, parameters
        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
    )
    ^
  File "/Users/shyukri/.local/share/uv/tools/cratedb-toolkit/lib/python3.13/site-packages/sqlalchemy/engine/base.py", line 1986, in _exec_single_context
    self._handle_dbapi_exception(
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~^
        e, str_statement, effective_parameters, cursor, context
        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
    )
    ^
  File "/Users/shyukri/.local/share/uv/tools/cratedb-toolkit/lib/python3.13/site-packages/sqlalchemy/engine/base.py", line 2363, in _handle_dbapi_exception
    raise sqlalchemy_exception.with_traceback(exc_info[2]) from e
  File "/Users/shyukri/.local/share/uv/tools/cratedb-toolkit/lib/python3.13/site-packages/sqlalchemy/engine/base.py", line 1967, in _exec_single_context
    self.dialect.do_execute(
    ~~~~~~~~~~~~~~~~~~~~~~~^
        cursor, str_statement, effective_parameters, context
        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
    )
    ^
  File "/Users/shyukri/.local/share/uv/tools/cratedb-toolkit/lib/python3.13/site-packages/sqlalchemy_cratedb/dialect.py", line 240, in do_execute
    result = cursor.execute(statement, parameters)
  File "/Users/shyukri/.local/share/uv/tools/cratedb-toolkit/lib/python3.13/site-packages/crate/client/cursor.py", line 57, in execute
    self._result = self.connection.client.sql(
                   ~~~~~~~~~~~~~~~~~~~~~~~~~~^
        sql, parameters, bulk_parameters
        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
    )
    ^
  File "/Users/shyukri/.local/share/uv/tools/cratedb-toolkit/lib/python3.13/site-packages/crate/client/http.py", line 508, in sql
    content = self._json_request("POST", self.path, data=data)
  File "/Users/shyukri/.local/share/uv/tools/cratedb-toolkit/lib/python3.13/site-packages/crate/client/http.py", line 639, in _json_request
    response = self._request(method, path, data=data)
  File "/Users/shyukri/.local/share/uv/tools/cratedb-toolkit/lib/python3.13/site-packages/crate/client/http.py", line 630, in _request
    self._drop_server(next_server, ex_message)
    ~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/Users/shyukri/.local/share/uv/tools/cratedb-toolkit/lib/python3.13/site-packages/crate/client/http.py", line 700, in _drop_server
    raise ConnectionError(
    ...<2 lines>...
    )
sqlalchemy.exc.OperationalError: (crate.client.exceptions.ConnectionError) No more Servers available, exception from last server: ('Connection aborted.', RemoteDisconnected('Remote end closed connection without response'))
[SQL: SELECT heap['max'] AS heap_size FROM sys.nodes LIMIT 1]
(Background on this error at: https://sqlalche.me/e/20/e3q8)

ssl=true

➜  cratedb-toolkit git:(main) ctk settings compare --cluster-url "crate://crate@localhost:4200/?ssl=true"                                                                                              [26/02/18| 6:24PM]
Comparing settings in crate://crate@localhost:4200/?ssl=true against default settings
2026-02-18 18:25:00,676 [urllib3.connectionpool              ] WARNING : Retrying (Retry(total=9, connect=None, read=0, redirect=None, status=None)) after connection broken by 'SSLError(SSLCertVerificationError(1, "[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: Hostname mismatch, certificate is not valid for 'localhost'. (_ssl.c:1028)"))': /
2026-02-18 18:25:00,818 [urllib3.connectionpool              ] WARNING : Retrying (Retry(total=8, connect=None, read=0, redirect=None, status=None)) after connection broken by 'SSLError(SSLCertVerificationError(1, "[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: Hostname mismatch, certificate is not valid for 'localhost'. (_ssl.c:1028)"))': /
2026-02-18 18:25:00,963 [urllib3.connectionpool              ] WARNING : Retrying (Retry(total=7, connect=None, read=0, redirect=None, status=None)) after connection broken by 'SSLError(SSLCertVerificationError(1, "[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: Hostname mismatch, certificate is not valid for 'localhost'. (_ssl.c:1028)"))': /
2026-02-18 18:25:01,104 [urllib3.connectionpool              ] WARNING : Retrying (Retry(total=6, connect=None, read=0, redirect=None, status=None)) after connection broken by 'SSLError(SSLCertVerificationError(1, "[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: Hostname mismatch, certificate is not valid for 'localhost'. (_ssl.c:1028)"))': /
2026-02-18 18:25:01,248 [urllib3.connectionpool              ] WARNING : Retrying (Retry(total=5, connect=None, read=0, redirect=None, status=None)) after connection broken by 'SSLError(SSLCertVerificationError(1, "[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: Hostname mismatch, certificate is not valid for 'localhost'. (_ssl.c:1028)"))': /
2026-02-18 18:25:01,387 [urllib3.connectionpool              ] WARNING : Retrying (Retry(total=4, connect=None, read=0, redirect=None, status=None)) after connection broken by 'SSLError(SSLCertVerificationError(1, "[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: Hostname mismatch, certificate is not valid for 'localhost'. (_ssl.c:1028)"))': /
2026-02-18 18:25:01,527 [urllib3.connectionpool              ] WARNING : Retrying (Retry(total=3, connect=None, read=0, redirect=None, status=None)) after connection broken by 'SSLError(SSLCertVerificationError(1, "[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: Hostname mismatch, certificate is not valid for 'localhost'. (_ssl.c:1028)"))': /
2026-02-18 18:25:01,671 [urllib3.connectionpool              ] WARNING : Retrying (Retry(total=2, connect=None, read=0, redirect=None, status=None)) after connection broken by 'SSLError(SSLCertVerificationError(1, "[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: Hostname mismatch, certificate is not valid for 'localhost'. (_ssl.c:1028)"))': /
2026-02-18 18:25:01,816 [urllib3.connectionpool              ] WARNING : Retrying (Retry(total=1, connect=None, read=0, redirect=None, status=None)) after connection broken by 'SSLError(SSLCertVerificationError(1, "[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: Hostname mismatch, certificate is not valid for 'localhost'. (_ssl.c:1028)"))': /
2026-02-18 18:25:01,953 [urllib3.connectionpool              ] WARNING : Retrying (Retry(total=0, connect=None, read=0, redirect=None, status=None)) after connection broken by 'SSLError(SSLCertVerificationError(1, "[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: Hostname mismatch, certificate is not valid for 'localhost'. (_ssl.c:1028)"))': /
2026-02-18 18:25:02,093 [cratedb_toolkit.docs.settings       ] INFO    : Extracting CrateDB settings from https://cratedb.com/docs/crate/reference/en/latest/config/cluster.html
⠙ Fetching documentation
⠙ Processing tables...
⠙ Processing definition lists...
⠙ Processing section headers...
⠙ Identifying runtime configurable settings...
2026-02-18 18:25:03,044 [cratedb_toolkit.docs.settings       ] INFO    : Extracted 83 settings in total
2026-02-18 18:25:03,044 [cratedb_toolkit.docs.settings       ] INFO    : Found 55 runtime configurable settings
2026-02-18 18:25:03,045 [cratedb_toolkit.docs.settings       ] INFO    : Generated 55 SQL statements for runtime configurable settings
2026-02-18 18:25:03,195 [urllib3.connectionpool              ] WARNING : Retrying (Retry(total=9, connect=None, read=0, redirect=None, status=None)) after connection broken by 'SSLError(SSLCertVerificationError(1, "[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: Hostname mismatch, certificate is not valid for 'localhost'. (_ssl.c:1028)"))': /_sql?types=true
2026-02-18 18:25:03,337 [urllib3.connectionpool              ] WARNING : Retrying (Retry(total=8, connect=None, read=0, redirect=None, status=None)) after connection broken by 'SSLError(SSLCertVerificationError(1, "[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: Hostname mismatch, certificate is not valid for 'localhost'. (_ssl.c:1028)"))': /_sql?types=true
2026-02-18 18:25:03,478 [urllib3.connectionpool              ] WARNING : Retrying (Retry(total=7, connect=None, read=0, redirect=None, status=None)) after connection broken by 'SSLError(SSLCertVerificationError(1, "[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: Hostname mismatch, certificate is not valid for 'localhost'. (_ssl.c:1028)"))': /_sql?types=true
2026-02-18 18:25:03,615 [urllib3.connectionpool              ] WARNING : Retrying (Retry(total=6, connect=None, read=0, redirect=None, status=None)) after connection broken by 'SSLError(SSLCertVerificationError(1, "[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: Hostname mismatch, certificate is not valid for 'localhost'. (_ssl.c:1028)"))': /_sql?types=true
2026-02-18 18:25:03,755 [urllib3.connectionpool              ] WARNING : Retrying (Retry(total=5, connect=None, read=0, redirect=None, status=None)) after connection broken by 'SSLError(SSLCertVerificationError(1, "[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: Hostname mismatch, certificate is not valid for 'localhost'. (_ssl.c:1028)"))': /_sql?types=true
2026-02-18 18:25:03,895 [urllib3.connectionpool              ] WARNING : Retrying (Retry(total=4, connect=None, read=0, redirect=None, status=None)) after connection broken by 'SSLError(SSLCertVerificationError(1, "[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: Hostname mismatch, certificate is not valid for 'localhost'. (_ssl.c:1028)"))': /_sql?types=true
2026-02-18 18:25:04,033 [urllib3.connectionpool              ] WARNING : Retrying (Retry(total=3, connect=None, read=0, redirect=None, status=None)) after connection broken by 'SSLError(SSLCertVerificationError(1, "[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: Hostname mismatch, certificate is not valid for 'localhost'. (_ssl.c:1028)"))': /_sql?types=true
2026-02-18 18:25:04,176 [urllib3.connectionpool              ] WARNING : Retrying (Retry(total=2, connect=None, read=0, redirect=None, status=None)) after connection broken by 'SSLError(SSLCertVerificationError(1, "[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: Hostname mismatch, certificate is not valid for 'localhost'. (_ssl.c:1028)"))': /_sql?types=true
2026-02-18 18:25:04,314 [urllib3.connectionpool              ] WARNING : Retrying (Retry(total=1, connect=None, read=0, redirect=None, status=None)) after connection broken by 'SSLError(SSLCertVerificationError(1, "[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: Hostname mismatch, certificate is not valid for 'localhost'. (_ssl.c:1028)"))': /_sql?types=true
2026-02-18 18:25:04,452 [urllib3.connectionpool              ] WARNING : Retrying (Retry(total=0, connect=None, read=0, redirect=None, status=None)) after connection broken by 'SSLError(SSLCertVerificationError(1, "[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: Hostname mismatch, certificate is not valid for 'localhost'. (_ssl.c:1028)"))': /_sql?types=true
2026-02-18 18:25:04,593 [crate.client.http                   ] WARNING : Removed server https://localhost:4200 from active pool
Traceback (most recent call last):
  File "/Users/shyukri/.local/share/uv/tools/cratedb-toolkit/lib/python3.13/site-packages/urllib3/connectionpool.py", line 464, in _make_request
    self._validate_conn(conn)
    ~~~~~~~~~~~~~~~~~~~^^^^^^
  File "/Users/shyukri/.local/share/uv/tools/cratedb-toolkit/lib/python3.13/site-packages/urllib3/connectionpool.py", line 1093, in _validate_conn
    conn.connect()
    ~~~~~~~~~~~~^^
  File "/Users/shyukri/.local/share/uv/tools/cratedb-toolkit/lib/python3.13/site-packages/urllib3/connection.py", line 796, in connect
    sock_and_verified = _ssl_wrap_socket_and_match_hostname(
        sock=sock,
    ...<14 lines>...
        assert_fingerprint=self.assert_fingerprint,
    )
  File "/Users/shyukri/.local/share/uv/tools/cratedb-toolkit/lib/python3.13/site-packages/urllib3/connection.py", line 975, in _ssl_wrap_socket_and_match_hostname
    ssl_sock = ssl_wrap_socket(
        sock=sock,
    ...<8 lines>...
        tls_in_tls=tls_in_tls,
    )
  File "/Users/shyukri/.local/share/uv/tools/cratedb-toolkit/lib/python3.13/site-packages/urllib3/util/ssl_.py", line 483, in ssl_wrap_socket
    ssl_sock = _ssl_wrap_socket_impl(sock, context, tls_in_tls, server_hostname)
  File "/Users/shyukri/.local/share/uv/tools/cratedb-toolkit/lib/python3.13/site-packages/urllib3/util/ssl_.py", line 527, in _ssl_wrap_socket_impl
    return ssl_context.wrap_socket(sock, server_hostname=server_hostname)
           ~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/Users/shyukri/.local/share/uv/python/cpython-3.13.5-macos-aarch64-none/lib/python3.13/ssl.py", line 455, in wrap_socket
    return self.sslsocket_class._create(
           ~~~~~~~~~~~~~~~~~~~~~~~~~~~~^
        sock=sock,
        ^^^^^^^^^^
    ...<5 lines>...
        session=session
        ^^^^^^^^^^^^^^^
    )
    ^
  File "/Users/shyukri/.local/share/uv/python/cpython-3.13.5-macos-aarch64-none/lib/python3.13/ssl.py", line 1076, in _create
    self.do_handshake()
    ~~~~~~~~~~~~~~~~~^^
  File "/Users/shyukri/.local/share/uv/python/cpython-3.13.5-macos-aarch64-none/lib/python3.13/ssl.py", line 1372, in do_handshake
    self._sslobj.do_handshake()
    ~~~~~~~~~~~~~~~~~~~~~~~~~^^
ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: Hostname mismatch, certificate is not valid for 'localhost'. (_ssl.c:1028)

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/Users/shyukri/.local/share/uv/tools/cratedb-toolkit/lib/python3.13/site-packages/urllib3/connectionpool.py", line 787, in urlopen
    response = self._make_request(
        conn,
    ...<10 lines>...
        **response_kw,
    )
  File "/Users/shyukri/.local/share/uv/tools/cratedb-toolkit/lib/python3.13/site-packages/urllib3/connectionpool.py", line 488, in _make_request
    raise new_e
urllib3.exceptions.SSLError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: Hostname mismatch, certificate is not valid for 'localhost'. (_ssl.c:1028)

The above exception was the direct cause of the following exception:

Traceback (most recent call last):
  File "/Users/shyukri/.local/share/uv/tools/cratedb-toolkit/lib/python3.13/site-packages/crate/client/http.py", line 587, in _request
    response = self.server_pool[next_server].request(
        method,
    ...<5 lines>...
        **kwargs,
    )
  File "/Users/shyukri/.local/share/uv/tools/cratedb-toolkit/lib/python3.13/site-packages/crate/client/http.py", line 196, in request
    return self.pool.urlopen(
           ~~~~~~~~~~~~~~~~~^
        method,
        ^^^^^^^
    ...<4 lines>...
        **kwargs,
        ^^^^^^^^^
    )
    ^
  File "/Users/shyukri/.local/share/uv/tools/cratedb-toolkit/lib/python3.13/site-packages/urllib3/connectionpool.py", line 871, in urlopen
    return self.urlopen(
           ~~~~~~~~~~~~^
        method,
        ^^^^^^^
    ...<13 lines>...
        **response_kw,
        ^^^^^^^^^^^^^^
    )
    ^
  File "/Users/shyukri/.local/share/uv/tools/cratedb-toolkit/lib/python3.13/site-packages/urllib3/connectionpool.py", line 871, in urlopen
    return self.urlopen(
           ~~~~~~~~~~~~^
        method,
        ^^^^^^^
    ...<13 lines>...
        **response_kw,
        ^^^^^^^^^^^^^^
    )
    ^
  File "/Users/shyukri/.local/share/uv/tools/cratedb-toolkit/lib/python3.13/site-packages/urllib3/connectionpool.py", line 871, in urlopen
    return self.urlopen(
           ~~~~~~~~~~~~^
        method,
        ^^^^^^^
    ...<13 lines>...
        **response_kw,
        ^^^^^^^^^^^^^^
    )
    ^
  [Previous line repeated 7 more times]
  File "/Users/shyukri/.local/share/uv/tools/cratedb-toolkit/lib/python3.13/site-packages/urllib3/connectionpool.py", line 841, in urlopen
    retries = retries.increment(
        method, url, error=new_e, _pool=self, _stacktrace=sys.exc_info()[2]
    )
  File "/Users/shyukri/.local/share/uv/tools/cratedb-toolkit/lib/python3.13/site-packages/urllib3/util/retry.py", line 535, in increment
    raise MaxRetryError(_pool, url, reason) from reason  # type: ignore[arg-type]
    ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
urllib3.exceptions.MaxRetryError: HTTPSConnectionPool(host='localhost', port=4200): Max retries exceeded with url: /_sql?types=true (Caused by SSLError(SSLCertVerificationError(1, "[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: Hostname mismatch, certificate is not valid for 'localhost'. (_ssl.c:1028)")))

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/Users/shyukri/.local/share/uv/tools/cratedb-toolkit/lib/python3.13/site-packages/sqlalchemy/engine/base.py", line 1967, in _exec_single_context
    self.dialect.do_execute(
    ~~~~~~~~~~~~~~~~~~~~~~~^
        cursor, str_statement, effective_parameters, context
        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
    )
    ^
  File "/Users/shyukri/.local/share/uv/tools/cratedb-toolkit/lib/python3.13/site-packages/sqlalchemy_cratedb/dialect.py", line 240, in do_execute
    result = cursor.execute(statement, parameters)
  File "/Users/shyukri/.local/share/uv/tools/cratedb-toolkit/lib/python3.13/site-packages/crate/client/cursor.py", line 57, in execute
    self._result = self.connection.client.sql(
                   ~~~~~~~~~~~~~~~~~~~~~~~~~~^
        sql, parameters, bulk_parameters
        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
    )
    ^
  File "/Users/shyukri/.local/share/uv/tools/cratedb-toolkit/lib/python3.13/site-packages/crate/client/http.py", line 508, in sql
    content = self._json_request("POST", self.path, data=data)
  File "/Users/shyukri/.local/share/uv/tools/cratedb-toolkit/lib/python3.13/site-packages/crate/client/http.py", line 639, in _json_request
    response = self._request(method, path, data=data)
  File "/Users/shyukri/.local/share/uv/tools/cratedb-toolkit/lib/python3.13/site-packages/crate/client/http.py", line 630, in _request
    self._drop_server(next_server, ex_message)
    ~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/Users/shyukri/.local/share/uv/tools/cratedb-toolkit/lib/python3.13/site-packages/crate/client/http.py", line 700, in _drop_server
    raise ConnectionError(
    ...<2 lines>...
    )
crate.client.exceptions.ConnectionError: No more Servers available, exception from last server: HTTPSConnectionPool(host='localhost', port=4200): Max retries exceeded with url: /_sql?types=true (Caused by SSLError(SSLCertVerificationError(1, "[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: Hostname mismatch, certificate is not valid for 'localhost'. (_ssl.c:1028)")))

The above exception was the direct cause of the following exception:

Traceback (most recent call last):
  File "/Users/shyukri/.local/bin/ctk", line 10, in <module>
    sys.exit(cli())
             ~~~^^
  File "/Users/shyukri/.local/share/uv/tools/cratedb-toolkit/lib/python3.13/site-packages/click/core.py", line 1161, in __call__
    return self.main(*args, **kwargs)
           ~~~~~~~~~^^^^^^^^^^^^^^^^^
  File "/Users/shyukri/.local/share/uv/tools/cratedb-toolkit/lib/python3.13/site-packages/click/core.py", line 1082, in main
    rv = self.invoke(ctx)
  File "/Users/shyukri/.local/share/uv/tools/cratedb-toolkit/lib/python3.13/site-packages/click/core.py", line 1697, in invoke
    return _process_result(sub_ctx.command.invoke(sub_ctx))
                           ~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^
  File "/Users/shyukri/.local/share/uv/tools/cratedb-toolkit/lib/python3.13/site-packages/click/core.py", line 1697, in invoke
    return _process_result(sub_ctx.command.invoke(sub_ctx))
                           ~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^
  File "/Users/shyukri/.local/share/uv/tools/cratedb-toolkit/lib/python3.13/site-packages/click/core.py", line 1443, in invoke
    return ctx.invoke(self.callback, **ctx.params)
           ~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/Users/shyukri/.local/share/uv/tools/cratedb-toolkit/lib/python3.13/site-packages/click/core.py", line 788, in invoke
    return __callback(*args, **kwargs)
  File "/Users/shyukri/.local/share/uv/tools/cratedb-toolkit/lib/python3.13/site-packages/cratedb_toolkit/settings/compare.py", line 378, in compare_cluster_settings
    heap_size_bytes = adapter.get_heap_size()
  File "/Users/shyukri/.local/share/uv/tools/cratedb-toolkit/lib/python3.13/site-packages/cratedb_toolkit/util/database.py", line 250, in get_heap_size
    rows = self.run_sql("SELECT heap['max'] AS heap_size FROM sys.nodes LIMIT 1", records=True)
  File "/Users/shyukri/.local/share/uv/tools/cratedb-toolkit/lib/python3.13/site-packages/cratedb_toolkit/util/database.py", line 131, in run_sql
    return self.run_sql_real(sql=sql_effective, parameters=parameters, records=records)
           ~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/Users/shyukri/.local/share/uv/tools/cratedb-toolkit/lib/python3.13/site-packages/cratedb_toolkit/util/database.py", line 150, in run_sql_real
    result = self.connection.execute(sa.text(statement), parameters)
  File "/Users/shyukri/.local/share/uv/tools/cratedb-toolkit/lib/python3.13/site-packages/sqlalchemy/engine/base.py", line 1419, in execute
    return meth(
        self,
        distilled_parameters,
        execution_options or NO_OPTIONS,
    )
  File "/Users/shyukri/.local/share/uv/tools/cratedb-toolkit/lib/python3.13/site-packages/sqlalchemy/sql/elements.py", line 527, in _execute_on_connection
    return connection._execute_clauseelement(
           ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^
        self, distilled_params, execution_options
        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
    )
    ^
  File "/Users/shyukri/.local/share/uv/tools/cratedb-toolkit/lib/python3.13/site-packages/sqlalchemy/engine/base.py", line 1641, in _execute_clauseelement
    ret = self._execute_context(
        dialect,
    ...<8 lines>...
        cache_hit=cache_hit,
    )
  File "/Users/shyukri/.local/share/uv/tools/cratedb-toolkit/lib/python3.13/site-packages/sqlalchemy/engine/base.py", line 1846, in _execute_context
    return self._exec_single_context(
           ~~~~~~~~~~~~~~~~~~~~~~~~~^
        dialect, context, statement, parameters
        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
    )
    ^
  File "/Users/shyukri/.local/share/uv/tools/cratedb-toolkit/lib/python3.13/site-packages/sqlalchemy/engine/base.py", line 1986, in _exec_single_context
    self._handle_dbapi_exception(
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~^
        e, str_statement, effective_parameters, cursor, context
        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
    )
    ^
  File "/Users/shyukri/.local/share/uv/tools/cratedb-toolkit/lib/python3.13/site-packages/sqlalchemy/engine/base.py", line 2363, in _handle_dbapi_exception
    raise sqlalchemy_exception.with_traceback(exc_info[2]) from e
  File "/Users/shyukri/.local/share/uv/tools/cratedb-toolkit/lib/python3.13/site-packages/sqlalchemy/engine/base.py", line 1967, in _exec_single_context
    self.dialect.do_execute(
    ~~~~~~~~~~~~~~~~~~~~~~~^
        cursor, str_statement, effective_parameters, context
        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
    )
    ^
  File "/Users/shyukri/.local/share/uv/tools/cratedb-toolkit/lib/python3.13/site-packages/sqlalchemy_cratedb/dialect.py", line 240, in do_execute
    result = cursor.execute(statement, parameters)
  File "/Users/shyukri/.local/share/uv/tools/cratedb-toolkit/lib/python3.13/site-packages/crate/client/cursor.py", line 57, in execute
    self._result = self.connection.client.sql(
                   ~~~~~~~~~~~~~~~~~~~~~~~~~~^
        sql, parameters, bulk_parameters
        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
    )
    ^
  File "/Users/shyukri/.local/share/uv/tools/cratedb-toolkit/lib/python3.13/site-packages/crate/client/http.py", line 508, in sql
    content = self._json_request("POST", self.path, data=data)
  File "/Users/shyukri/.local/share/uv/tools/cratedb-toolkit/lib/python3.13/site-packages/crate/client/http.py", line 639, in _json_request
    response = self._request(method, path, data=data)
  File "/Users/shyukri/.local/share/uv/tools/cratedb-toolkit/lib/python3.13/site-packages/crate/client/http.py", line 630, in _request
    self._drop_server(next_server, ex_message)
    ~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/Users/shyukri/.local/share/uv/tools/cratedb-toolkit/lib/python3.13/site-packages/crate/client/http.py", line 700, in _drop_server
    raise ConnectionError(
    ...<2 lines>...
    )
sqlalchemy.exc.OperationalError: (crate.client.exceptions.ConnectionError) No more Servers available, exception from last server: HTTPSConnectionPool(host='localhost', port=4200): Max retries exceeded with url: /_sql?types=true (Caused by SSLError(SSLCertVerificationError(1, "[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: Hostname mismatch, certificate is not valid for 'localhost'. (_ssl.c:1028)")))
[SQL: SELECT heap['max'] AS heap_size FROM sys.nodes LIMIT 1]
(Background on this error at: https://sqlalche.me/e/20/e3q8)

[amotl]

Still no luck, tried with ssl=true and ssl=false.

Thanks, and sorry. However, you should know if you are connecting to an SSL-based host, right? ;] Because in the second output we can spot CERTIFICATE_VERIFY_FAILED: Hostname mismatch, certificate is not valid for 'localhost', I assume it is an SSL-based host.

2026-02-18 18:25:00,676 [urllib3.connectionpool              ] 
WARNING : Retrying (Retry(total=9, connect=None, read=0, redirect=None, status=None)) after connection broken by
'SSLError(SSLCertVerificationError(1, "[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: Hostname mismatch, certificate is not valid for 'localhost'. (_ssl.c:1028)"))': /

I think there is currently no way to turn hostname validation off, is that the root cause? How did you do that when connecting to CrateDB in similar scenarios, @WalBeh?

[amotl]

@goat-ssh: What about this incantation shared by @WalBeh?

uv tool install --upgrade cratedb-toolkit
ctk settings compare --cluster-url "crate://crate@localhost:4200/?sslmode=require"

[goat-ssh]

#  uv tool install --upgrade cratedb-toolkit
.....

Installed 5 executables: cratedb-cfr, cratedb-retention, cratedb-toolkit, ctk, migr8
Traceback (most recent call last):
  File "/Users/shyukri/.local/bin/ctk", line 4, in <module>
    from cratedb_toolkit.cli import cli
  File "/Users/shyukri/.local/share/uv/tools/cratedb-toolkit/lib/python3.13/site-packages/cratedb_toolkit/cli.py", line 7, in <module>
    from .cfr.cli import cli as cfr_cli
  File "/Users/shyukri/.local/share/uv/tools/cratedb-toolkit/lib/python3.13/site-packages/cratedb_toolkit/cfr/cli.py", line 13, in <module>
    from cratedb_toolkit.cfr.systable import Archive, SystemTableExporter, SystemTableImporter
  File "/Users/shyukri/.local/share/uv/tools/cratedb-toolkit/lib/python3.13/site-packages/cratedb_toolkit/cfr/systable.py", line 27, in <module>
    import pandas as pd
ModuleNotFoundError: No module named 'pandas'

[amotl]

That's the solution, sorry for the hiccup and the obstacles. Alongside ctk, please install the sqlalchemy-cratedb package like this.

pip install sqlalchemy-cratedb==0.42.0.dev2

Then, use the ?sslmode=require parameter to turn off hostname validation, see crate/sqlalchemy-cratedb#202.

NB: Let's loop your recent post about installation problems into a different issue, ok? See GH-659.

[amotl]

That's a one-shot command that should now work fluently?

uvx --with='sqlalchemy-cratedb==0.42.0.dev2' 'cratedb-toolkit[settings]' \
  settings compare --cluster-url "crate://crate@localhost:4201/?sslmode=require"