{"record":{"id":"4f5fd4b984f11369","repo":"appsmithorg/appsmith","slug":"the-certificate-crtfile-is-invalid-n-err-me","errorCode":null,"errorMessage":"The certificate \"${crtFile}\" is invalid.\\n${err.message}","messagePattern":"The certificate \"(.+?)\" is invalid\\.\\\\n(.+?)","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"app/client/config/getHttpsConfig.js","lineNumber":17,"sourceCode":"'use strict';\n\nconst fs = require('fs');\nconst path = require('path');\nconst crypto = require('crypto');\nconst chalk = require('react-dev-utils/chalk');\nconst paths = require('./paths');\n\n// Ensure the certificate and key provided are valid and if not\n// throw an easy to debug error\nfunction validateKeyAndCerts({ cert, key, keyFile, crtFile }) {\n  let encrypted;\n  try {\n    // publicEncrypt will throw an error with an invalid cert\n    encrypted = crypto.publicEncrypt(cert, Buffer.from('test'));\n  } catch (err) {\n    throw new Error(\n      `The certificate \"${chalk.yellow(crtFile)}\" is invalid.\\n${err.message}`\n    );\n  }\n\n  try {\n    // privateDecrypt will throw an error with an invalid key\n    crypto.privateDecrypt(key, encrypted);\n  } catch (err) {\n    throw new Error(\n      `The certificate key \"${chalk.yellow(keyFile)}\" is invalid.\\n${\n        err.message\n      }`\n    );\n  }\n}\n\n// Read file and throw an error if it doesn't exist\nfunction readEnvFile(file, type) {","sourceCodeStart":1,"sourceCodeEnd":35,"githubUrl":"https://github.com/appsmithorg/appsmith/blob/8cd9021c24cdbea1c3c12c966073708e83db60c2/app/client/config/getHttpsConfig.js#L1-L35","documentation":"Thrown by config/getHttpsConfig.js during the local dev-server HTTPS setup. validateKeyAndCerts() calls crypto.publicEncrypt(cert, ...) as a sanity check; a malformed, expired, wrong-format, or non-X.509 certificate makes publicEncrypt throw, which is re-wrapped with the offending file path. The message embeds the original crypto error (err.message) so you can see the precise parse failure.","triggerScenarios":"Starting the dev server with HTTPS=true and SSL_CRT_FILE pointing at a certificate that is not valid PEM/X.509, is corrupted, is a CA bundle instead of a leaf cert, or uses an unsupported key algorithm. crypto.publicEncrypt fails on the first malformed cert in the chain.","commonSituations":"Self-signed certs generated with wrong openssl flags; cert files saved with CRLF or BOM corruption; pointing SSL_CRT_FILE at a .key or .csr by mistake; certs generated for a different key type (e.g. EC cert with RSA expectations); copy-paste truncation when adding the PEM to a Docker volume.","solutions":["Regenerate a valid self-signed cert: 'mkcert localhost 127.0.0.1 ::1' or 'openssl req -x509 -newkey rsa:2048 -nodes -keyout key.pem -out cert.pem -days 365'.","Verify the file is PEM-formatted X.509: 'openssl x509 -in $SSL_CRT_FILE -text -noout' must succeed without error.","Confirm SSL_CRT_FILE points to the leaf certificate (BEGIN CERTIFICATE), not the private key or a CSR.","Strip any BOM/CRLF: 'sed -i \"s/\\r$//\" cert.pem' and re-save as UTF-8 without BOM."],"exampleFix":"# before\nSSL_CRT_FILE=./cert.csr SSL_KEY_FILE=./key.pem HTTPS=true npm start\n# -> The certificate \"./cert.csr\" is invalid.\n\n# after\nSSL_CRT_FILE=./cert.pem SSL_KEY_FILE=./key.pem HTTPS=true npm start","handlingStrategy":"validation","validationCode":"const fs = require('fs');\nconst { SSL_CRT_FILE } = process.env;\nif (SSL_CRT_FILE) {\n  const { execSync } = require('child_process');\n  execSync(`openssl x509 -in \"${SSL_CRT_FILE}\" -noout`, { stdio: 'pipe' });\n}","typeGuard":null,"tryCatchPattern":"try { getHttpsConfig(); } catch (e) {\n  if (/certificate .* is invalid/i.test(e.message)) { /* prompt to regenerate cert */ }\n  else throw e;\n}","preventionTips":["Validate the cert with 'openssl x509 -in cert.pem -noout' before starting the dev server.","Generate dev certs with mkcert so they are well-formed by construction.","Keep cert and key in a version-controlled location (gitignored) with a fixed absolute path."],"tags":["https","tls","certificates","dev-server","configuration"],"backgroundTag":null,"analyzedSha":"8cd9021c24cdbea1c3c12c966073708e83db60c2","analyzedAt":"2026-08-12T22:14:19.293Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}