{"record":{"id":"25c3d7fa09a1483b","repo":"we-promise/sure","slug":"ssl-could-not-create-combined-ca-bundle-using-c","errorCode":null,"errorMessage":"[SSL] Could not create combined CA bundle, using custom CA only. Connections to public services (not using your custom CA) may fail.","messagePattern":"\\[SSL\\] Could not create combined CA bundle, using custom CA only\\. Connections to public services \\(not using your custom CA\\) may fail\\.","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"config/initializers/00_ssl.rb","lineNumber":258,"sourceCode":"    ca_file_status = SslInitializerHelper.validate_ca_certificate_file(ca_file)\n    config.x.ssl.ca_file = ca_file_status[:path]\n    config.x.ssl.ca_file_valid = ca_file_status[:valid]\n    config.x.ssl.ca_file_error = ca_file_status[:error]\n\n    # Create combined CA bundle and set SSL_CERT_FILE for global SSL configuration.\n    #\n    # This sets ENV[\"SSL_CERT_FILE\"] globally so that ALL Ruby SSL connections\n    # (including gems like openid_connect that bypass SslConfigurable) will trust\n    # both system CAs (for public services) and the custom CA (for self-signed services).\n    if ca_file_status[:valid]\n      combined_path = SslInitializerHelper.create_combined_ca_bundle(ca_file_status[:path])\n      if combined_path\n        config.x.ssl.combined_ca_bundle = combined_path\n        ENV[\"SSL_CERT_FILE\"] = combined_path\n        Rails.logger.info(\"[SSL] Set SSL_CERT_FILE=#{combined_path} for global SSL configuration\")\n      else\n        # Fallback: just use the custom CA (may break connections to public services)\n        Rails.logger.warn(\"[SSL] Could not create combined CA bundle, using custom CA only. \" \\\n          \"Connections to public services (not using your custom CA) may fail.\")\n        ENV[\"SSL_CERT_FILE\"] = ca_file_status[:path]\n      end\n    end\n  end\n\n  # Log configuration summary at startup\n  SslInitializerHelper.log_ssl_configuration(config.x.ssl)\nend\n","sourceCodeStart":240,"sourceCodeEnd":268,"githubUrl":"https://github.com/we-promise/sure/blob/e69894adb92547273377398c15f45c979cd9416a/config/initializers/00_ssl.rb#L240-L268","documentation":"Startup warning from config/initializers/00_ssl.rb (line 258) when a custom CA is valid but SslInitializerHelper.create_combined_ca_bundle returns nil — the combined system+custom bundle at tmp/ssl_ca_bundle.pem could not be produced (e.g. system CA missing/unreadable, or tmp/ not writable). The initializer then falls back to ENV['SSL_CERT_FILE'] = the custom CA path only, so OpenSSL will trust ONLY your custom CA and TLS handshakes to public services (Plaid, Wise, etc.) will likely fail certificate verification.","triggerScenarios":"Booting with a valid custom CA configured while the system CA bundle cannot be found or read, or tmp/ lacks write permission for the app user; any File.read/File.write error inside create_combined_ca_bundle is swallowed into the nil return.","commonSituations":"Minimal containers missing ca-certificates (root cause shared with the 'Could not find system CA bundle' warning); read-only or permission-restricted tmp directories in hardened deploys; volume mounts shadowing tmp/ssl_ca_bundle.pem with a directory.","solutions":["Install the system CA package (ca-certificates) so the combined bundle can be built; check boot logs for the paired 'Could not find system CA bundle' warning.","Ensure the Rails tmp/ directory is writable by the app user and no stale directory exists at tmp/ssl_ca_bundle.pem.","After fixing, confirm the log line 'Set SSL_CERT_FILE=.../tmp/ssl_ca_bundle.pem' appears instead of the fallback warning.","Interim workaround for a single endpoint: set SSL_CERT_FILE manually to a bundle you assemble, but the durable fix is repairing system CA + tmp writability."],"exampleFix":"// before\n# custom CA valid, tmp/ read-only -> warning; public TLS fails\n\n// after\nRUN apt-get update && apt-get install -y ca-certificates\nRUN mkdir -p /app/tmp && chown app:app /app/tmp","handlingStrategy":"fallback","validationCode":"writable = File.writable?(Rails.root.join('tmp'))\nsystem_ca = File.readable?('/etc/ssl/certs/ca-certificates.crt')\nRails.logger.warn('combined CA bundle will fail') unless writable && system_ca","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Make tmp/ writable by the app user and keep ca-certificates installed in the image.","After boot, assert ENV['SSL_CERT_FILE'] points at tmp/ssl_ca_bundle.pem, not the custom-CA-only fallback.","Monitor for this warning in deploy logs; it predicts public-endpoint TLS failures before users report them."],"tags":["ssl","tls","ca-bundle","environment","startup-warning"],"backgroundTag":"ca-bundle-merge-failure","analyzedSha":"e69894adb92547273377398c15f45c979cd9416a","analyzedAt":"2026-08-21T18:22:41.165Z","schemaVersion":2},"datasetVersion":"2026-08-21T23:17:16.201Z"}