{"record":{"id":"16e20f7623ec4a04","repo":"openai/codex","slug":"failed-to-load-ca-certificates-from-selected-by","errorCode":null,"errorMessage":"Failed to load CA certificates from {} selected by {}: {detail}. {hint}","messagePattern":"Failed to load CA certificates from (.+?) selected by (.+?): (.+?)\\. (.+?)","errorType":"exception","errorClass":"BuildCustomCaTransportError","httpStatus":null,"severity":"error","filePath":"codex-rs/http-client/src/custom_ca.rs","lineNumber":89,"sourceCode":"/// because the final reqwest client builder failed. Callers that do not care about the\n/// distinction can rely on the `From<BuildCustomCaTransportError> for io::Error` conversion.\n#[derive(Debug, Error)]\npub enum BuildCustomCaTransportError {\n    /// Reading the selected CA file from disk failed before any PEM parsing could happen.\n    #[error(\n        \"Failed to read CA certificate file {} selected by {}: {source}. {hint}\",\n        path.display(),\n        source_env,\n        hint = CA_CERT_HINT\n    )]\n    ReadCaFile {\n        source_env: &'static str,\n        path: PathBuf,\n        source: io::Error,\n    },\n\n    /// The selected CA file was readable, but did not produce usable certificate material.\n    #[error(\n        \"Failed to load CA certificates from {} selected by {}: {detail}. {hint}\",\n        path.display(),\n        source_env,\n        hint = CA_CERT_HINT\n    )]\n    InvalidCaFile {\n        source_env: &'static str,\n        path: PathBuf,\n        detail: String,\n    },\n\n    /// One parsed certificate block could not be registered with the reqwest client builder.\n    #[error(\n        \"Failed to parse certificate #{certificate_index} from {} selected by {}: {source}. {hint}\",\n        path.display(),\n        source_env,\n        hint = CA_CERT_HINT\n    )]","sourceCodeStart":71,"sourceCodeEnd":107,"githubUrl":"https://github.com/openai/codex/blob/339751715c64496cb86246bfb3935f40e309dd3d/codex-rs/http-client/src/custom_ca.rs#L71-L107","documentation":"The CA file was read successfully but produced no usable certificate material, so the custom CA bundle could not be loaded. This InvalidCaFile variant of BuildCustomCaTransportError fires during PEM processing when the file exists and is readable yet contains no valid CERTIFICATE blocks or otherwise unusable material; the `detail` string describes the specific parse/loader failure and the hint points at the env var that selected the file.","triggerScenarios":"Thrown at codex-rs/http-client/src/custom_ca.rs:89 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Ensure the file is PEM-encoded and contains one or more complete BEGIN CERTIFICATE...END CERTIFICATE blocks","Re-export the CA bundle from its source (e.g. re-download the corporate root CA) in PEM format rather than DER","Validate the file with `openssl x509 -in $CODEX_CA_CERTIFICATE -noout -text` to confirm it parses","Unset CODEX_CA_CERTIFICATE/SSL_CERT_FILE to use system roots if a custom CA is not required"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"339751715c64496cb86246bfb3935f40e309dd3d","analyzedAt":"2026-08-25T05:35:09.876Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}