{"record":{"id":"742571b37098cea9","repo":"tauri-apps/tauri","slug":"failed-to-parse-tauri-dev-root-certificate","errorCode":null,"errorMessage":"failed to parse TAURI_DEV_ROOT_CERTIFICATE","messagePattern":"failed to parse TAURI_DEV_ROOT_CERTIFICATE","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/tauri/src/protocol/tauri.rs","lineNumber":59,"sourceCode":"    let mut client_builder = reqwest::ClientBuilder::new();\n    if use_https {\n      #[cfg(feature = \"rustls-tls\")]\n      if rustls::crypto::CryptoProvider::get_default().is_none() {\n        let _ = rustls::crypto::ring::default_provider().install_default();\n      }\n\n      // we can't load env vars at runtime, gotta embed them in the lib\n      #[allow(unused_variables)]\n      if let Some(cert_pem) = option_env!(\"TAURI_DEV_ROOT_CERTIFICATE\") {\n        #[cfg(any(\n          feature = \"native-tls\",\n          feature = \"native-tls-vendored\",\n          feature = \"rustls-tls\"\n        ))]\n        {\n          log::info!(\"adding dev server root certificate\");\n          let certificate = reqwest::Certificate::from_pem(cert_pem.as_bytes())\n            .expect(\"failed to parse TAURI_DEV_ROOT_CERTIFICATE\");\n          client_builder = client_builder.tls_certs_merge([certificate]);\n        }\n\n        #[cfg(not(any(\n          feature = \"native-tls\",\n          feature = \"native-tls-vendored\",\n          feature = \"rustls-tls\"\n        )))]\n        {\n          log::warn!(\n            \"the dev root-certificate-path option was provided, but you must enable one of the following Tauri features in Cargo.toml: native-tls, native-tls-vendored, rustls-tls\"\n          );\n        }\n      } else {\n        log::warn!(\n          \"loading HTTPS URL; you might need to provide a certificate via the `dev --root-certificate-path` option. You must enable one of the following Tauri features in Cargo.toml: native-tls, native-tls-vendored, rustls-tls\"\n        );\n      }","sourceCodeStart":41,"sourceCodeEnd":77,"githubUrl":"https://github.com/tauri-apps/tauri/blob/52e4b6e71d8632a7e648f866c442e287ecddee34/crates/tauri/src/protocol/tauri.rs#L41-L77","documentation":"If TAURI_DEV_ROOT_CERTIFICATE is set when the tauri crate is COMPILED (option_env!), its bytes are embedded and added as a trusted root certificate for the dev-server HTTPS client via reqwest::Certificate::from_pem. The expect panics at app startup in dev when the embedded value is not a valid PEM certificate.","triggerScenarios":"TAURI_DEV_ROOT_CERTIFICATE containing DER/binary cert data, malformed base64, missing -----BEGIN CERTIFICATE----- / -----END CERTIFICATE----- markers, or a bundle with PEM blocks reqwest cannot use. The panic happens at runtime even though the env var was captured at compile time.","commonSituations":"Exporting a CA as .cer/.der; concatenating extra PEM sections (keys, CRLs); truncated file; stale embedded value after changing the env var without a rebuild (rust option_env! is compile-time).","solutions":["Convert DER to PEM: openssl x509 -inform der -in ca.cer -out ca.pem and use that content.","Ensure the value is a valid PEM CERTIFICATE block (correct base64 and BEGIN/END lines).","After changing the value, fully rebuild so the new env var is embedded.","Validate quickly: openssl x509 -in ca.pem -noout must succeed.","Unset the variable if a custom dev root CA is no longer needed."],"exampleFix":"# before\nexport TAURI_DEV_ROOT_CERTIFICATE=\"$(cat ca.cer)\"   # DER bytes -> panic\n\n# after\nopenssl x509 -inform der -in ca.cer -out ca.pem\nexport TAURI_DEV_ROOT_CERTIFICATE=\"$(cat ca.pem)\"   # valid PEM\ncargo clean && cargo tauri dev","handlingStrategy":"validation","validationCode":"# fail fast if the PEM is invalid, before compiling tauri\nopenssl x509 -in \"$TAURI_DEV_ROOT_CERTIFICATE\" -noout >/dev/null \\\n  || { echo 'TAURI_DEV_ROOT_CERTIFICATE is not a valid PEM certificate'; exit 1; }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always validate the certificate with openssl x509 -noout before setting the env var.","Remember option_env! is compile-time: rebuild after changing TAURI_DEV_ROOT_CERTIFICATE.","Store the PEM as a file (PEM CERTIFICATE block only) and export its contents; avoid DER/.cer files."],"tags":["tauri","dev-server","https","certificate","pem","env-var"],"backgroundTag":"invalid-pem-certificate","analyzedSha":"52e4b6e71d8632a7e648f866c442e287ecddee34","analyzedAt":"2026-08-20T13:59:20.734Z","contentChangedAt":"2026-08-20T13:59:20.734Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}