Selekta BETA ID Download for Mac
DOC 22

Troubleshooting

Updated 23 October 2026

Find the message you see on this page, then apply the fix under it. Selekta shows the server's own message whenever there is one, so text in angle brackets such as <host> stands for the value from your connection.

Most connection problems show up when you click Test in the connection dialog. The test stops at the failing step and tells you what to change.

Cannot connect

Connection refused

Connection refused on <host> port <port>.

Nothing is listening at that host and port. Check that the server is running and that the port is right: PostgreSQL usually listens on 5432, MySQL on 3306 and SQL Server on 1433. If the server is in a private network, click Set up SSH tunnel and connect through a bastion. See SSH and TLS.

Host not found

Could not resolve <host>. Check the spelling or your VPN.

The host name does not resolve. Fix the spelling, or connect to the VPN that publishes that name.

macOS Local Network access

macOS blocked Selekta from reaching <host> on your local network. Allow Selekta in System Settings › Privacy & Security › Local Network, then connect again.

macOS asks once whether Selekta may reach devices on your local network. If you declined, connections to private addresses fail. Turn Selekta on in System Settings › Privacy & Security › Local Network.

Timeouts

Message Fix
No answer from <host> after <n> s. A firewall may be dropping traffic, or you need the VPN. Click Open Advanced and raise Connect timeout (s). The default is 10 s.
SSH <host>:<port> did not answer after <n> s The SSH bastion did not answer. Check its host, port and your network.
No TLS answer from <host>:<port> The server accepted the connection but never finished the TLS handshake. Check that the port speaks TLS.
Timed out waiting for a database connection Every connection to the server was busy. Wait for running queries to finish, or cancel one.

Other connection messages

  • File not found at <path>: a SQLite connection points to a file that moved or was deleted. Edit the connection and choose the file again.
  • Connection is not open or The connection of this session was closed: the connection was closed or dropped. Connect again from the navigator.
  • Use either the SSH tunnel or the VPN for this connection, not both: turn one of them off on the connection.

Sign-in and the Keychain

Password rejected

The server's own message is shown, for example password authentication failed for user "<user>" (PostgreSQL), Access denied for user '<user>'@'<address>' (MySQL) or Login failed for user '<user>' (SQL Server).

  1. Check the password. Retype it in the Password field and click Test again.
  2. If the password is right, the server may not accept this user from your address. On PostgreSQL that is a pg_hba.conf rule; on MySQL the account's allowed host; on SQL Server the login may need SQL authentication enabled or access to this database.

If a saved password stops working, for example after it was rotated, Selekta asks for it when you connect: "The server rejected the saved password (password authentication failed). It may have been rotated." Enter the new one and keep Update the password in macOS Keychain ticked.

SSH sign-in

Message Fix
SSH authentication failed for <user>@<host> The bastion rejected the user, password or key. Check the SSH user and the key the bastion expects.
Cannot read SSH key <path>: <reason> The key file is missing, unreadable, or protected by a passphrase you did not enter.
The SSH server <host>:<port> could not reach the database at <db host>:<port> Signed in to the bastion, but it refused to forward to the database. Enter the database host as the bastion sees it (often 127.0.0.1 or a private address), and check that the bastion allows TCP forwarding for your user.
SSH <host>:<port>: <reason> The SSH connection failed for another reason, quoted from the SSH library.

Keychain

Passwords are stored in the macOS Keychain under id.kreasimaju.selekta, never on disk.

  • "Could not store the password in macOS Keychain": the connection was saved without the password, and Selekta asks for it when you connect. This usually means the Keychain is locked or you denied access. Unlock it in Keychain Access and save the connection again.
  • "No password for <user> is saved in macOS Keychain.": the Keychain item is missing. Enter the password when asked and tick Update the password in macOS Keychain.

If macOS asks whether Selekta may use a Keychain item, choose Always Allow so it does not ask on every connect.

TLS and SSH host keys

Server certificate not trusted

The test pauses at the TLS handshake and shows Server certificate not trusted: <host>:<port> presented a certificate that the macOS system trust store does not trust. No password has been sent at that point. The dialog shows the certificate's subject, issuer, expiry and SHA-256 fingerprint.

  • If your organisation uses its own certificate authority, click Switch to verify-full with a CA file… (VERIFY_IDENTITY on MySQL, Encrypt and verify on SQL Server) and choose the CA certificate.
  • If you have checked the fingerprint with the server's owner, click Trust this certificate for this connection. Selekta pins that certificate for this connection only. Expired certificates cannot be trusted this way.

Other TLS messages

Message Fix
<host>:<port> presented a different certificate than the one trusted for this connection The pinned certificate changed. If the server's certificate was renewed, confirm the new fingerprint and trust it again. If not, do not connect.
<host> negotiated TLS 1.2; this connection requires TLS 1.3 Minimum TLS is set to 1.3 and the server offered less. Enable TLS 1.3 on the server, or set Minimum TLS to 1.2 on the SSL tab.
TLS handshake with <host>:<port> failed: <reason> The handshake failed, for example on a protocol or cipher mismatch. The reason names the cause.
Cannot read client certificate or key: <reason> The client certificate or key file is not valid PEM, or the files do not match.

SSH host key unknown

The first time you connect through a bastion, the test pauses with Verify SSH host key. Compare the fingerprint with the one the bastion's owner published, then click Trust and connect. Selekta writes the key to ~/.ssh/known_hosts and asks again only if it changes.

SSH host key changed

SSH host key changed means: The SSH host key of <host>:<port> does not match the one in ~/.ssh/known_hosts. The connection is blocked. The dialog shows the stored and the presented fingerprint and the line of known_hosts the old key is on.

Someone may be intercepting the connection, or the server was reinstalled. Ask the bastion's owner which fingerprint is correct. Only then click Remove stored key…, confirm with Remove key, and test again to trust the new key.

Cannot read ~/.ssh/known_hosts or Cannot write ~/.ssh/known_hosts means the file or the ~/.ssh folder has the wrong permissions. Fix them in Terminal, for example with chmod 700 ~/.ssh and chmod 600 ~/.ssh/known_hosts.

Permissions and read-only

Permission denied

Message Fix
permission denied for schema <schema>. Role <role> needs USAGE on it. Ask for GRANT USAGE ON SCHEMA <schema> TO <role>, or open another schema.
permission denied for table <name> (and other objects) The connection's role lacks the privilege. Use a role that has it, or ask for a grant.
<role> cannot read the definition of <db>.<name> MySQL: the account cannot see this object's definition.
<role> cannot read the definition of <object> (needs VIEW DEFINITION) SQL Server: ask for VIEW DEFINITION on the object or schema.
Permission denied: cannot write to <folder>. Choose a folder you own, such as ~/Downloads. Export or backup to a folder you can write to.
Can't read <file>: permission denied. Check the file's permissions in Finder or copy it to a folder you own. Import: copy the file somewhere you own, for example Downloads.

Read-only connection

Message Meaning
<connection> is read-only: <VERB> statements are blocked A statement that writes was stopped before anything was sent.
<connection> is read-only: statements that change the read-only setting are blocked Statements that would turn off the database's own read-only mode are blocked too.
<connection> is read-only: changes cannot be applied Grid edits cannot be applied.
<connection> is read-only: import is blocked or restore is blocked Import and restore need a writable connection.

SELECT, EXPLAIN and SHOW still run. To write, use a read-write connection, or right-click the connection and choose Turn off read-only. On Production, Selekta asks you to confirm. See Production safety.

Transactions

Transaction aborted

The transaction is aborted; roll back to continue

On PostgreSQL, once a statement fails inside a transaction, the server refuses every further statement until you roll back. The editor says "The transaction is now aborted: roll back before running anything else on this tab." Click Rollback or press ⌥⌘⌫, fix the statement and run it again.

If you commit an aborted transaction, nothing is saved: The transaction was aborted, so it was rolled back instead of committed, and the toast says "Nothing was committed".

Other transaction messages

  • Commit or roll back the pending statements before switching to auto-commit: finish the open transaction first. Commit is ⌥⌘↵.
  • MySQL commits the open transaction implicitly before this statement: commit or roll back the <n> pending statements first: DDL such as CREATE or ALTER commits on MySQL. Selekta stops it so your pending statements are not committed by surprise.
  • Query cancelled; the connection was reset, so the open transaction was rolled back: the query did not stop when cancelled, so Selekta reset the connection. Pending changes in that transaction were rolled back.
  • Run one statement at a time, or use Run script (⌥X): the selection holds several statements. Press ⌥X to run them as a script.

Backup and restore tools

Message Fix
<tool> not found. with the list of searched places Install the client tools, for example brew install libpq or brew install mysql-client, then click Search again, or Choose path… to point at the tool.
<tool> <version> is older than the server (<server>). Install a client with the server's major version or newer and choose its path.
<tool> stopped: role <user> cannot read table <table>. Back up with a role that has SELECT on every table, or click Exclude.
Database <db> does not exist on <connection>. Click Create … and retry, or pick an existing database. Nothing was changed.
This is a <engine> dump; the target is <engine>. Restore the file into a connection of the right engine.
This file is gzip-compressed; decompress it first Run gunzip on the file, then restore the result.
This folder is not a pg_dump directory archive (no toc.dat) Choose the folder pg_dump wrote, the one that contains toc.dat.
Restoring into <connection> overwrites its data; confirm first Confirm in the dialog. On Production, type the connection name.
Backup for SQL Server is not available yet; export tables as SQL instead Use Export as SQL….
The backup would overwrite the database file itself; choose another file SQLite: save the backup under another name.

Where Selekta looks for the tools and which versions it needs: Backup and restore.

Import and export files

Wrong encoding

This file is not valid UTF-8: invalid byte 0x<XX> at byte offset <n> (line <n>).

The file was saved in another encoding, often by a spreadsheet. Selekta switches Encoding to Windows-1252 for you. Click Read again with Windows-1252, check that accented characters look right in the mapping step, or try ISO-8859-1 (Latin-1).

Not a CSV file

<file> is not a delimited text file (it looks like an Excel workbook). Save it as CSV and choose it again. The same message ending in (it contains binary data) means the file is not text at all. Open it in your spreadsheet, save as CSV, and choose the CSV file.

Wrong delimiter

If every row lands in a single column on the Mapping step, the delimiter was not detected. Set Delimiter to Comma, Semicolon, Tab or Pipe by hand. Files from spreadsheets in many locales use semicolons and decimal commas; tick Decimal comma (1.234,56) for those.

Row and value errors

  • <column> is NOT NULL and has no default: map a source column to it.: map a file column to that column.
  • "<value>" is not a valid integer, not a valid number, not a valid timestamp, too long: <n> characters, column is varchar(<n>): fix the value in the file, or choose Skip bad rows and fix the rejected rows file later.

Export messages

Message Fix
Export runs a single query; this text holds several statements Select one statement before exporting.
Export runs a single query (SELECT); this statement would change data Export a SELECT.
The result has more than 1,048,575 rows, the most an XLSX sheet holds. Export it as CSV, or narrow the query. Use CSV, or add a WHERE or LIMIT.
Not enough free space on <folder> Make room on the disk or choose another one. The partial file was deleted.