{"record":{"id":"7414988d3bd03234","repo":"oven-sh/bun","slug":"loadcafile","errorCode":null,"errorMessage":"LoadCAFile","messagePattern":"LoadCAFile","errorType":"error_code","errorClass":"InitError","httpStatus":null,"severity":"critical","filePath":"src/http/InitError.rs","lineNumber":5,"sourceCode":"#[derive(Debug, Clone, Copy, PartialEq, Eq, thiserror::Error, strum::IntoStaticStr)]\npub enum InitError {\n    #[error(\"FailedToOpenSocket\")]\n    FailedToOpenSocket,\n    #[error(\"LoadCAFile\")]\n    LoadCAFile,\n    #[error(\"InvalidCAFile\")]\n    InvalidCAFile,\n    #[error(\"InvalidCA\")]\n    InvalidCA,\n    #[error(\"InvalidCRL\")]\n    InvalidCRL,\n}\n","sourceCodeStart":1,"sourceCodeEnd":14,"githubUrl":"https://github.com/oven-sh/bun/blob/8c5296ac459e8252d3cd702f3fbcbb0c249d95d5/src/http/InitError.rs#L1-L14","documentation":"The configured CA bundle file could not be loaded (uws create_bun_socket_error_t::load_ca_file mapped at src/http/HTTPContext.rs:518). The HTTP-thread init handler distinguishes 'failed to find CA file' (path doesn't exist) from 'failed to load CA file' (exists but unreadable) before crashing the process (src/http/HTTPThread.rs:338-361, 379). The path comes from `cafile` in npm/bun config (`BUN_CONFIG_CAFILE`, .npmrc/bunfig.toml cafile) or equivalent fetch/Bun.install TLS settings.","triggerScenarios":"First HTTPS request or `bun install` with `cafile = /path/ca.pem` (bunfig.toml), BUN_CONFIG_CAFILE, or npm config cafile pointing to a nonexistent path, a file with wrong permissions, or an unreadable mount (empty Docker volume, k8s secret not yet mounted).","commonSituations":"Corporate-proxy setups where the internal CA path is hardcoded per-platform and differs in CI; Docker images where the CA file is COPYied to a different path than bunfig.toml states; typos or `~` expansion that config parsing does not perform; Kubernetes secrets mounted after process start.","solutions":["Check the exact path from the error message with `ls -l <path>` on the machine that crashed — fix the bunfig/npmrc/BUN_CONFIG_CAFILE value to an existing absolute path.","Ensure the process user has read permission on the CA file (common failure: root-owned 600 file read by non-root container user).","In containers, verify the CA file is actually baked into the image at the configured path (docker run --rm image ls -l /path).","If ~/.npmrc carries a stale cafile from another machine, override with BUN_CONFIG_CAFILE pointing to the right bundle."],"exampleFix":"# before (bunfig.toml)\n[install]\ncafile = \"~/certs/internal-ca.pem\"   # '~' not expanded / file missing\n# after\n[install]\ncafile = \"/etc/ssl/corp/internal-ca.pem\"  # absolute, readable path","handlingStrategy":"validation","validationCode":"import { existsSync, accessSync, constants } from 'node:fs';\nconst cafile = process.env.BUN_CONFIG_CAFILE ?? parseBunfigCafile();\nif (cafile && !existsSync(cafile)) throw new Error(`CA file not found: ${cafile}`);\nif (cafile) accessSync(cafile, constants.R_OK); // throws if unreadable\nawait fetch('https://example.com'); // safe now","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Use absolute paths for cafile — tilde/relative paths bite in CI and containers","Add a startup smoke test that stats the CA file before the first HTTPS request","Bake the CA into the container image and assert its presence in the entrypoint"],"tags":["tls","ca","config","crash","install","network"],"backgroundTag":null,"analyzedSha":"8c5296ac459e8252d3cd702f3fbcbb0c249d95d5","analyzedAt":"2026-08-16T08:01:58.794Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}