{"record":{"id":"1ecf1fad3eb0fdd4","repo":"musistudio/claude-code-router","slug":"status-message","errorCode":null,"errorMessage":"${status.message}","messagePattern":"\\$\\{status\\.message\\}","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/core/src/proxy/service.ts","lineNumber":626,"sourceCode":"          state: \"untrusted\",\n          trusted: false\n        };\n      }\n    }\n\n    return {\n      ...base,\n      canInstall: false,\n      message: \"Automatic certificate trust detection is not supported on this platform. Import the CA certificate manually before enabling proxy mode.\",\n      state: \"unsupported\",\n      trusted: false\n    };\n  }\n\n  private async requireTrustedCertificate(): Promise<void> {\n    const status = await this.getCertificateStatus();\n    if (!status.trusted) {\n      throw new Error(status.message);\n    }\n  }\n\n  private async handleConnect(request: IncomingMessage, clientSocket: Socket, head: Buffer): Promise<void> {\n    const target = parseConnectTarget(request.url);\n    const mitmServer = await this.getMitmServer(target.hostname);\n    const localSocket = net.connect(mitmServer.port, \"127.0.0.1\");\n    localSocket.once(\"connect\", () => {\n      clientSocket.write(\"HTTP/1.1 200 Connection Established\\r\\nProxy-agent: CCR-MITM\\r\\n\\r\\n\");\n      if (head.length > 0) {\n        localSocket.write(head);\n      }\n      localSocket.pipe(clientSocket);\n      clientSocket.pipe(localSocket);\n    });\n    localSocket.once(\"error\", (error) => {\n      handleConnectError(request, clientSocket, error);\n    });","sourceCodeStart":608,"sourceCodeEnd":644,"githubUrl":"https://github.com/musistudio/claude-code-router/blob/99f24806c6a2c660b16e53e95211c517448a6c90/packages/core/src/proxy/service.ts#L608-L644","documentation":"Thrown by the proxy service when the MITM CA certificate is not trusted by the OS trust store. Before starting or attaching, the service checks certificate status and refuses to operate if the certificate has not been installed/trusted, since HTTPS interception would fail with TLS errors downstream.","triggerScenarios":"Calling start() or attach() on the proxy service when the generated CA certificate was never installed into the system/OS trust store, or was installed but the store check (getCertificateStatus()) reports trusted=false (e.g. missing on Linux NSS store, or keychain trust settings changed).","commonSituations":"First run on Linux where certutil/NSS DB is absent; corporate policies resetting trust stores; deleted certificate; running in a container without the trust step; macOS user approved keychain but system-wide trust missing.","solutions":["Install/trust the proxy CA certificate (use the library's certificate install API or add it to the OS trust store) and retry start()","Run getCertificateStatus() first and surface its message to guide installation","On Linux ensure nss tools (certutil) are installed so the trust check can succeed","If in CI/container, pre-bake the certificate into the image's trust store"],"exampleFix":"// before\nawait proxy.start(); // throws status.message\n\n// after\nconst status = await proxy.getCertificateStatus();\nif (!status.trusted) {\n  await proxy.installCertificate(); // or follow status.message instructions\n}\nawait proxy.start();","handlingStrategy":"validation","validationCode":"const status = await proxy.getCertificateStatus();\nif (!status.trusted) {\n  throw new Error(`Certificate not trusted: ${status.message}`);\n}\nawait proxy.start();","typeGuard":null,"tryCatchPattern":"try { await proxy.start(); } catch (e) { if (/trust|certificate/i.test(e.message)) await installAndRetry(); else throw e; }","preventionTips":["Check getCertificateStatus() before start()/attach()","Automate certificate installation as part of environment provisioning","In containers/CI, pre-install the CA into the image trust store"],"tags":["proxy","mitm","tls","certificate","trust-store"],"backgroundTag":"certificate-not-trusted","analyzedSha":"99f24806c6a2c660b16e53e95211c517448a6c90","analyzedAt":"2026-08-27T04:11:01.184Z","schemaVersion":2},"datasetVersion":"2026-08-27T08:17:20.692Z"}