{"record":{"id":"31286592d668f969","repo":"git-ecosystem/git-credential-manager","slug":"custom-certificate-bundle-not-found-at-path-0","errorCode":null,"errorMessage":"Custom certificate bundle not found at path: {0}","messagePattern":"Custom certificate bundle not found at path: (.+?)","errorType":"exception","errorClass":"Trace2FileNotFoundException","httpStatus":null,"severity":"error","filePath":"src/Core/HttpClientFactory.cs","lineNumber":117,"sourceCode":"                _console.WriteWarning(\"| TLS certificate verification has been disabled! |\");\n                _console.WriteWarning(\"---------------------------------------------------\");\n                _console.WriteWarning($\"HTTPS connections may not be secure. See {Constants.HelpUrls.GcmTlsVerification} for more information.\");\n\n                handler.ServerCertificateCustomValidationCallback = (req, cert, chain, errors) => true;\n            }\n            // If schannel is the TLS backend, custom certificate usage must be explicitly enabled\n            else if (!string.IsNullOrWhiteSpace(_settings.CustomCertificateBundlePath) &&\n                ((_settings.TlsBackend != TlsBackend.Schannel) || _settings.UseCustomCertificateBundleWithSchannel))\n            {\n                string certBundlePath = _settings.CustomCertificateBundlePath;\n                _trace.WriteLine($\"Custom certificate verification has been enabled with certificate bundle at {certBundlePath}\");\n\n                // Throw exception if cert bundle file not found\n                if (!_fileSystem.FileExists(certBundlePath))\n                {\n                    var format = \"Custom certificate bundle not found at path: {0}\";\n                    var message = string.Format(format, certBundlePath);\n                    throw new Trace2FileNotFoundException(_trace2, message, format, certBundlePath);\n                }\n\n                Func<X509Certificate2, X509Chain, SslPolicyErrors, bool> validationCallback = (cert, chain, errors) =>\n                {\n                    // Fail immediately if there are non-chain issues with the remote cert\n                    if ((errors & ~SslPolicyErrors.RemoteCertificateChainErrors) != 0)\n                    {\n                        return false;\n                    }\n\n                    // Import the custom certs\n                    X509Certificate2Collection certBundle = new X509Certificate2Collection();\n                    certBundle.ImportFromPemFile(certBundlePath);\n\n                    try\n                    {\n                        // Add the certs to the chain\n                        chain.ChainPolicy.ExtraStore.AddRange(certBundle);","sourceCodeStart":99,"sourceCodeEnd":135,"githubUrl":"https://github.com/git-ecosystem/git-credential-manager/blob/e8ce762cd04b4100ae637b5fbf39ef9d0a96561e/src/Core/HttpClientFactory.cs#L99-L135","documentation":"HttpClientFactory.CreateClient validates the custom certificate bundle path from configuration (http.sslCAInfo / customCertBundle) using the injected filesystem; if the file does not exist it throws Trace2FileNotFoundException. This prevents silently running TLS without the intended CA bundle.","triggerScenarios":"Creating an HTTP client when a custom certificate bundle path is configured but the file is absent at that path (typo, deleted file, container image missing the CA file).","commonSituations":"Corporate proxy setups with a custom CA bundle, GCM_SSL_CA_INFO or http.sslCAInfo pointing at a path not mounted in the environment, or moving configs between machines.","solutions":["Verify the path in the message exists: ls <path> — fix typos in the configured bundle path","Point the config (http.sslCAInfo / GCM_SSL_CA_INFO) at an existing PEM bundle","Copy/ship the CA bundle into the environment (container image, mounted volume)","Remove the custom bundle setting if the default OS certificate store should be used instead"],"exampleFix":"// before\ngit config --global http.sslCAInfo /etc/ssl/company-ca.pem // file missing\n// after\nls /etc/ssl/company-ca.pem || echo missing\n# install the bundle or:\ngit config --global --unset http.sslCAInfo","handlingStrategy":"validation","validationCode":"var bundlePath = config.Get(\"http.sslCAInfo\");\nif (!string.IsNullOrEmpty(bundlePath) && !File.Exists(bundlePath))\n    throw new FileNotFoundException($\"Custom certificate bundle not found: {bundlePath}\");","typeGuard":"bool BundleExists(string path) => !string.IsNullOrEmpty(path) && File.Exists(path);","tryCatchPattern":"try\n{\n    var client = factory.CreateClient();\n}\ncatch (Trace2FileNotFoundException ex) when (ex.Message.StartsWith(\"Custom certificate bundle not found\"))\n{\n    logger.LogError(ex, \"Fix http.sslCAInfo/GCM_SSL_CA_INFO path or unset it to use the OS store\");\n}","preventionTips":["Verify the CA bundle path exists at startup (fail fast with a clear message)","Ship the CA bundle with the application/container and reference it via an absolute path","Prefer absolute paths over relative ones in TLS config to avoid cwd-dependent failures"],"tags":["tls","certificate-bundle","file-not-found","http-client"],"backgroundTag":"file-not-found","analyzedSha":"e8ce762cd04b4100ae637b5fbf39ef9d0a96561e","analyzedAt":"2026-09-11T17:15:08.753Z","contentChangedAt":"2026-09-11T17:15:08.753Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}