{"record":{"id":"2fbde42b54e00497","repo":"openai/codex","slug":"failed-to-read-ca-certificate-file-selected-by","errorCode":null,"errorMessage":"Failed to read CA certificate file {} selected by {}: {source}. {hint}","messagePattern":"Failed to read CA certificate file (.+?) selected by (.+?): (.+?)\\. (.+?)","errorType":"exception","errorClass":"BuildCustomCaTransportError","httpStatus":null,"severity":"error","filePath":"codex-rs/http-client/src/custom_ca.rs","lineNumber":76,"sourceCode":"use tracing::info;\nuse tracing::warn;\n\npub const CODEX_CA_CERT_ENV: &str = \"CODEX_CA_CERTIFICATE\";\npub const SSL_CERT_FILE_ENV: &str = \"SSL_CERT_FILE\";\nconst CA_CERT_HINT: &str = \"If you set CODEX_CA_CERTIFICATE or SSL_CERT_FILE, ensure it points to a PEM file containing one or more CERTIFICATE blocks, or unset it to use system roots.\";\ntype PemSection = (SectionKind, Vec<u8>);\n\n/// Describes why a transport using shared custom CA support could not be constructed.\n///\n/// These failure modes apply to both reqwest client construction and websocket TLS\n/// configuration. A build can fail because the configured CA file could not be read, could not be\n/// parsed as certificates, contained certs that the target TLS stack refused to register, or\n/// because the final reqwest client builder failed. Callers that do not care about the\n/// distinction can rely on the `From<BuildCustomCaTransportError> for io::Error` conversion.\n#[derive(Debug, Error)]\npub enum BuildCustomCaTransportError {\n    /// Reading the selected CA file from disk failed before any PEM parsing could happen.\n    #[error(\n        \"Failed to read CA certificate file {} selected by {}: {source}. {hint}\",\n        path.display(),\n        source_env,\n        hint = CA_CERT_HINT\n    )]\n    ReadCaFile {\n        source_env: &'static str,\n        path: PathBuf,\n        source: io::Error,\n    },\n\n    /// The selected CA file was readable, but did not produce usable certificate material.\n    #[error(\n        \"Failed to load CA certificates from {} selected by {}: {detail}. {hint}\",\n        path.display(),\n        source_env,\n        hint = CA_CERT_HINT\n    )]","sourceCodeStart":58,"sourceCodeEnd":94,"githubUrl":"https://github.com/openai/codex/blob/339751715c64496cb86246bfb3935f40e309dd3d/codex-rs/http-client/src/custom_ca.rs#L58-L94","documentation":"Error \"Failed to read CA certificate file {} selected by {}: {source}. {hint}\" thrown in openai/codex.","triggerScenarios":"Thrown at codex-rs/http-client/src/custom_ca.rs:76 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":[],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"339751715c64496cb86246bfb3935f40e309dd3d","analyzedAt":"2026-08-25T05:35:09.876Z","schemaVersion":2},"datasetVersion":"2026-08-25T06:17:31.827Z"}