{"record":{"id":"86546545fdbd617d","repo":"hatoo/oha","slug":"failed-to-parse-cacert-pem","errorCode":null,"errorMessage":"Failed to parse cacert_pem","messagePattern":"Failed to parse cacert_pem","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/tls_config.rs","lineNumber":96,"sourceCode":"#[cfg(all(feature = \"native-tls\", not(feature = \"rustls\")))]\npub struct NativeTlsConnectors {\n    pub no_alpn: tokio_native_tls::TlsConnector,\n    pub alpn_h2: tokio_native_tls::TlsConnector,\n}\n\n#[cfg(all(feature = \"native-tls\", not(feature = \"rustls\")))]\nimpl NativeTlsConnectors {\n    pub fn new(\n        insecure: bool,\n        cacert_pem: Option<&[u8]>,\n        client_auth: Option<(&[u8], &[u8])>,\n    ) -> Self {\n        let new = |is_http2: bool| {\n            let mut connector_builder = native_tls::TlsConnector::builder();\n\n            if let Some(cacert_pem) = cacert_pem {\n                let cert = native_tls::Certificate::from_pem(cacert_pem)\n                    .expect(\"Failed to parse cacert_pem\");\n                connector_builder.add_root_certificate(cert);\n            }\n\n            if insecure {\n                connector_builder\n                    .danger_accept_invalid_certs(true)\n                    .danger_accept_invalid_hostnames(true);\n            }\n\n            if let Some((cert, key)) = client_auth {\n                let cert = native_tls::Identity::from_pkcs8(cert, key)\n                    .expect(\"Failed to parse client_auth cert/key\");\n                connector_builder.identity(cert);\n            }\n\n            if is_http2 {\n                connector_builder.request_alpns(&[\"h2\"]);\n            }","sourceCodeStart":78,"sourceCodeEnd":114,"githubUrl":"https://github.com/hatoo/oha/blob/4efba2d113d165aaaf7533f5d2893e7cc57ebfc1/src/tls_config.rs#L78-L114","documentation":"NativeTlsConnectors::new parses the user-supplied cacert_pem bytes with native_tls::Certificate::from_pem and panics via expect() when the bytes are not valid PEM-encoded certificate data. The input at fault is the custom --cacert file: malformed PEM, DER-only, empty, or containing multiple/unexpected blocks.","triggerScenarios":"Thrown at src/tls_config.rs:96 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Confirm the file is PEM format, starting with '-----BEGIN CERTIFICATE-----'.","Re-export the certificate in PEM form (e.g. openssl x509 -inform der -in cert.der -out cert.pem).","Check the file is not empty or truncated and contains the full chain.","Validate the PEM with 'openssl x509 -in cert.pem -noout' before passing it."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"4efba2d113d165aaaf7533f5d2893e7cc57ebfc1","analyzedAt":"2026-09-09T16:24:23.306Z","contentChangedAt":"2026-09-09T16:24:23.306Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}