{"record":{"id":"0cfb549f8ac35223","repo":"openai/codex","slug":"failed-to-generate-ca-key-pair-err","errorCode":null,"errorMessage":"failed to generate CA key pair: {err}","messagePattern":"failed to generate CA key pair: (.+?)","errorType":"exception","errorClass":"anyhow::Error","httpStatus":null,"severity":"error","filePath":"codex-rs/network-proxy/src/certs.rs","lineNumber":681,"sourceCode":"            \"failed to prune stale managed MITM CA artifact lease: {err}\"\n        );\n    }\n}\n\nfn generate_ca() -> Result<(String, KeyPair)> {\n    let mut params = CertificateParams::default();\n    params.is_ca = IsCa::Ca(BasicConstraints::Unconstrained);\n    params.key_usages = vec![\n        KeyUsagePurpose::KeyCertSign,\n        KeyUsagePurpose::DigitalSignature,\n        KeyUsagePurpose::KeyEncipherment,\n    ];\n    let mut dn = DistinguishedName::new();\n    dn.push(DnType::CommonName, \"network_proxy MITM CA\");\n    params.distinguished_name = dn;\n\n    let key_pair = KeyPair::generate_for(&PKCS_ECDSA_P256_SHA256)\n        .map_err(|err| anyhow!(\"failed to generate CA key pair: {err}\"))?;\n    let cert = params\n        .self_signed(&key_pair)\n        .map_err(|err| anyhow!(\"failed to generate CA cert: {err}\"))?;\n    Ok((cert.pem(), key_pair))\n}\n\nfn write_atomic_create_new(path: &Path, contents: &[u8], mode: u32) -> Result<()> {\n    let parent = path\n        .parent()\n        .ok_or_else(|| anyhow!(\"missing parent directory\"))?;\n\n    let nanos = SystemTime::now()\n        .duration_since(UNIX_EPOCH)\n        .unwrap_or_default()\n        .as_nanos();\n    let pid = std::process::id();\n    let file_name = path.file_name().unwrap_or_default().to_string_lossy();\n    let tmp_path = parent.join(format!(\".{file_name}.tmp.{pid}.{nanos}\"));","sourceCodeStart":663,"sourceCodeEnd":699,"githubUrl":"https://github.com/openai/codex/blob/339751715c64496cb86246bfb3935f40e309dd3d/codex-rs/network-proxy/src/certs.rs#L663-L699","documentation":"Error \"failed to generate CA key pair: {err}\" thrown in openai/codex.","triggerScenarios":"Thrown at codex-rs/network-proxy/src/certs.rs:681 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":[],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"339751715c64496cb86246bfb3935f40e309dd3d","analyzedAt":"2026-08-25T05:35:09.876Z","schemaVersion":2},"datasetVersion":"2026-08-25T06:17:31.827Z"}