{"record":{"id":"081f6e65371882f2","repo":"openai/codex","slug":"startup-ca-bundle-contained-no-certificates","errorCode":null,"errorMessage":"startup CA bundle contained no certificates: {}","messagePattern":"startup CA bundle contained no certificates: (.+?)","errorType":"exception","errorClass":"anyhow::Error","httpStatus":null,"severity":"error","filePath":"codex-rs/network-proxy/src/certs.rs","lineNumber":339,"sourceCode":"    }\n    let mut seen = HashSet::new();\n    certificates.retain(|cert| cert != &managed_ca_cert && seen.insert(cert.as_ref().to_vec()));\n    Ok(certificates)\n}\n\nfn read_ca_certificates(path: &Path) -> Result<Vec<CertificateDer<'static>>> {\n    let pem = fs::read(path)\n        .with_context(|| format!(\"failed to read startup CA bundle: {}\", path.display()))?;\n    let pem = String::from_utf8_lossy(&pem);\n    let contains_trusted_certificates = pem.contains(\"TRUSTED CERTIFICATE\");\n    let normalized_pem = pem\n        .replace(\"BEGIN TRUSTED CERTIFICATE\", \"BEGIN CERTIFICATE\")\n        .replace(\"END TRUSTED CERTIFICATE\", \"END CERTIFICATE\");\n    let certs = CertificateDer::pem_slice_iter(normalized_pem.as_bytes())\n        .collect::<std::result::Result<Vec<_>, _>>()\n        .with_context(|| format!(\"failed to parse startup CA bundle: {}\", path.display()))?;\n    if certs.is_empty() {\n        return Err(anyhow!(\n            \"startup CA bundle contained no certificates: {}\",\n            path.display()\n        ));\n    }\n    certs\n        .into_iter()\n        .map(|cert| {\n            let cert = if contains_trusted_certificates {\n                first_der_item(cert.as_ref()).ok_or_else(|| {\n                    anyhow!(\n                        \"startup CA bundle contained an invalid trusted certificate: {}\",\n                        path.display()\n                    )\n                })?\n            } else {\n                cert.as_ref()\n            };\n            Ok(CertificateDer::from(cert.to_vec()))","sourceCodeStart":321,"sourceCodeEnd":357,"githubUrl":"https://github.com/openai/codex/blob/339751715c64496cb86246bfb3935f40e309dd3d/codex-rs/network-proxy/src/certs.rs#L321-L357","documentation":"Error \"startup CA bundle contained no certificates: {}\" thrown in openai/codex.","triggerScenarios":"Thrown at codex-rs/network-proxy/src/certs.rs:339 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":[],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"339751715c64496cb86246bfb3935f40e309dd3d","analyzedAt":"2026-08-25T05:35:09.876Z","schemaVersion":2},"datasetVersion":"2026-08-25T06:17:31.827Z"}