{"record":{"id":"676586eede44ae97","repo":"denoland/deno","slug":"not-yet-implemented","errorCode":null,"errorMessage":"not yet implemented","messagePattern":"not yet implemented","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"error","filePath":"ext/tls/lib.rs","lineNumber":321,"sourceCode":"    cert_chain_and_key: maybe_cert_chain_and_key,\n    socket_use,\n  } = options;\n  if let Some(ic_allowlist) = unsafely_ignore_certificate_errors {\n    let client_config = ClientConfig::builder()\n      .dangerous()\n      .with_custom_certificate_verifier(Arc::new(\n        NoCertificateVerification::new(ic_allowlist),\n      ));\n\n    // NOTE(bartlomieju): this if/else is duplicated at the end of the body of this function.\n    // However it's not really feasible to deduplicate it as the `client_config` instances\n    // are not type-compatible - one wants \"client cert\", the other wants \"transparency policy\n    // or client cert\".\n    let mut client = match maybe_cert_chain_and_key {\n      TlsKeys::Static(TlsKey(cert_chain, private_key)) => client_config\n        .with_client_auth_cert(cert_chain, private_key.clone_key())?,\n      TlsKeys::Null => client_config.with_no_client_auth(),\n      TlsKeys::Resolver(_) => unimplemented!(),\n    };\n\n    client.key_log = get_ssl_key_log();\n    add_alpn(&mut client, socket_use);\n    return Ok(client);\n  }\n\n  let mut root_cert_store =\n    root_cert_store.unwrap_or_else(create_default_root_cert_store);\n  // If custom certs are specified, add them to the store\n  for cert in ca_certs {\n    let reader = &mut BufReader::new(Cursor::new(cert));\n    // This function does not return specific errors, if it fails give a generic message.\n    for r in rustls_pemfile::certs(reader) {\n      match r {\n        Ok(cert) => {\n          root_cert_store.add(cert)?;\n        }","sourceCodeStart":303,"sourceCodeEnd":339,"githubUrl":"https://github.com/denoland/deno/blob/9ad36f7a2cce60488e6ec52283efb32efddaf93a/ext/tls/lib.rs#L303-L339","documentation":"create_client_config supports three TLS key sources: static PEM material (TlsKeys::Static), no client cert (TlsKeys::Null), and a per-connection resolver (TlsKeys::Resolver). In the branch taken when unsafely_ignore_certificate_errors is active, the resolver variant is an unimplemented!() stub, so combining certificate-error ignore lists with a TLS key resolver panics.","triggerScenarios":"Setting TlsClientConfigOptions with unsafely_ignore_certificate_errors = Some(...) and cert_chain_and_key = TlsKeys::Resolver(...), then calling create_client_config.","commonSituations":"Dynamic client-certificate provisioning (per-tenant certs via resolver) misconfigured together with the debug flag that ignores certificate errors.","solutions":["Remove unsafely_ignore_certificate_errors when using a key resolver","Switch to TlsKeys::Static with a PEM cert chain and key","Track upstream support for the resolver + ignore-errors combination before enabling both"],"exampleFix":"// before\nlet opts = TlsClientConfigOptions {\n  unsafely_ignore_certificate_errors: Some(vec![\"bad.host\".into()]),\n  cert_chain_and_key: TlsKeys::Resolver(resolver),\n  ..Default::default()\n};\n\n// after\nlet opts = TlsClientConfigOptions {\n  unsafely_ignore_certificate_errors: None,\n  cert_chain_and_key: TlsKeys::Static(TlsKey(cert_pem, key_pem)),\n  ..Default::default()\n};","handlingStrategy":"type-guard","validationCode":"fn config_supported(opts: &TlsClientConfigOptions) -> bool {\n  let resolver_used = matches!(opts.cert_chain_and_key, TlsKeys::Resolver(_));\n  let ignores_cert_errors = opts.unsafely_ignore_certificate_errors.is_some();\n  !(resolver_used && ignores_cert_errors)\n}","typeGuard":"match (&opts.cert_chain_and_key, opts.unsafely_ignore_certificate_errors.is_some()) {\n  (TlsKeys::Resolver(_), true) => /* unsupported combination: reject early */,\n  _ => create_client_config(opts)?,\n}","tryCatchPattern":null,"preventionTips":["Never combine dynamic TLS key resolvers with --unsafely-ignore-certificate-errors style options","Encode supported TlsKeys/flag combinations in your configuration schema validation"],"tags":["tls","rustls","client-certificate","unimplemented","ignore-certificate-errors"],"backgroundTag":"unimplemented-feature-path","analyzedSha":"9ad36f7a2cce60488e6ec52283efb32efddaf93a","analyzedAt":"2026-08-20T13:07:44.778Z","contentChangedAt":"2026-08-20T13:07:44.778Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}