{"record":{"id":"76e30b149c5f3e96","repo":"diegosouzapw/OmniRoute","slug":"certificate-install-failed","errorCode":null,"errorMessage":"Certificate install failed","messagePattern":"Certificate install failed","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"src/mitm/cert/install.ts","lineNumber":390,"sourceCode":"  try {\n    const config = getLinuxCertConfig();\n    const destFile = `${config.dir}/${LINUX_CERT_NAME}`;\n\n    await execFileWithPassword(\"sudo\", [\"-S\", \"mkdir\", \"-p\", config.dir], sudoPassword);\n    await execFileWithPassword(\"sudo\", [\"-S\", \"cp\", certPath, destFile], sudoPassword);\n    // #9442: `cp` inherits the process umask. A restrictive umask (e.g. PM2\n    // UMask=0077) creates the system cert as 0600 root:root, unreadable by\n    // non-root TLS clients. Force the public cert to 0644 (world-readable).\n    await execFileWithPassword(\"sudo\", [\"-S\", \"chmod\", \"0644\", destFile], sudoPassword);\n    await execFileWithPassword(\"sudo\", [\"-S\", config.cmd], sudoPassword);\n\n    await updateNssDatabases(certPath, \"add\");\n  } catch (error) {\n    const message = getErrorMessage(error);\n    const msg = message.includes(\"canceled\")\n      ? \"User canceled authorization\"\n      : \"Certificate install failed\";\n    throw new Error(msg);\n  }\n}\n\n/**\n * #9442 — ensure the system trust-store cert is world-readable (mode 0644).\n *\n * `installCertLinux()` now sets the mode explicitly after `cp`, but a cert\n * installed by an older build (before the chmod was added) may still be 0600\n * from a restrictive umask. `checkCertInstalledLinux()` only compares\n * fingerprints, so {@link installCert}'s already-installed branch calls this\n * helper to repair the mode on re-run. Best-effort: a stat/chmod failure\n * (e.g. dest removed between the fingerprint check and here) is swallowed —\n * the caller still reports \"already installed\" and a fresh install will run\n * next time the fingerprint no longer matches.\n */\nexport async function ensureSystemCertMode(destFile: string, sudoPassword: string): Promise<void> {\n  try {\n    const mode = fs.statSync(destFile).mode & 0o777;","sourceCodeStart":372,"sourceCodeEnd":408,"githubUrl":"https://github.com/diegosouzapw/OmniRoute/blob/a179ffed5bb2e0b883b9ae7214ce8717b2a94c4d/src/mitm/cert/install.ts#L372-L408","documentation":"Error \"Certificate install failed\" thrown in diegosouzapw/OmniRoute.","triggerScenarios":"Thrown at src/mitm/cert/install.ts:390 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":[],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"a179ffed5bb2e0b883b9ae7214ce8717b2a94c4d","analyzedAt":"2026-08-25T18:35:09.898Z","schemaVersion":2},"datasetVersion":"2026-08-25T21:54:21.419Z"}