{"record":{"id":"8d32cac71419ba17","repo":"oven-sh/bun","slug":"openssl-failed-stderr","errorCode":null,"errorMessage":"openssl failed: ${stderr}","messagePattern":"openssl failed: (.+?)","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"bench/snippets/http3-hello.js","lineNumber":36,"sourceCode":"    [\n      \"req\",\n      \"-x509\",\n      \"-nodes\",\n      \"-newkey\",\n      \"rsa:2048\",\n      \"-days\",\n      \"365\",\n      \"-subj\",\n      \"/CN=localhost\",\n      \"-keyout\",\n      keyPath,\n      \"-out\",\n      certPath,\n    ],\n    { stdio: [\"ignore\", \"ignore\", \"pipe\"] },\n  );\n  if (status !== 0) {\n    throw new Error(\"openssl failed: \" + stderr);\n  }\n  cert = readFileSync(certPath, \"utf8\");\n  key = readFileSync(keyPath, \"utf8\");\n}\n\nconst TOTAL = 10_000_000;\nvar i = 0;\n\nconst server = Bun.serve({\n  port: 3001,\n  http3: true,\n  http1: true,\n  tls: { cert, key, rejectUnauthorized: false },\n  routes: { \"/hi\": new Response(\"hello!\") },\n  fetch(req) {\n    if (i++ === TOTAL - 1) setTimeout(() => server.stop().then(() => process.exit(0)));\n    return new Response(\"Hello, World!\" + i);\n  },","sourceCodeStart":18,"sourceCodeEnd":54,"githubUrl":"https://github.com/oven-sh/bun/blob/8c5296ac459e8252d3cd702f3fbcbb0c249d95d5/bench/snippets/http3-hello.js#L18-L54","documentation":"The http3-hello benchmark generates a self-signed localhost certificate by spawning `openssl req` (365 days, /CN=localhost, writing key and cert to temp paths). If the openssl process exits non-zero, the script throws with openssl's captured stderr appended. The real cause is in that stderr: openssl is missing, not on PATH, or rejected the arguments/output paths.","triggerScenarios":"Spawning openssl for `openssl req -x509 -newkey ...` when the binary is absent, the -keyout/-out directory is unwritable, or an OpenSSL config/version incompatibility makes req fail. stdio is set so stderr is piped and included in the message.","commonSituations":"Minimal CI containers or slim Docker images without openssl; PATH differences when Bun spawns the child; leftover read-only cert/key files at the target paths; OpenSSL 3.x config parsing issues.","solutions":["Check availability and version: `which openssl && openssl version`; install if missing (brew install openssl / apt-get install openssl)","Copy the exact `openssl req` invocation from bench/snippets/http3-hello.js and run it manually to see the full error","Make sure the keyPath/certPath directories are writable and stale files are removed","Re-run the benchmark once the manual command succeeds"],"exampleFix":"# before: openssl not installed -> 'openssl failed: ...not found'\n# after\nbrew install openssl   # macOS\nsudo apt-get install -y openssl   # Debian/Ubuntu","handlingStrategy":"validation","validationCode":"const openssl = Bun.which('openssl') ?? process.env.OPENSSL_BIN;\nif (!openssl) throw new Error('openssl is required to generate the benchmark certificate');","typeGuard":null,"tryCatchPattern":"try {\n  generateCert();\n} catch (e) {\n  if (String(e.message).startsWith('openssl failed:')) {\n    console.error('Run the openssl req command manually to see the failure; check PATH and output paths');\n  }\n  throw e;\n}","preventionTips":["Check for external tool dependencies with Bun.which/which before spawning them, and name the missing binary in the error","Include the spawned command in failure messages so users can reproduce the openssl error verbatim","Cache generated certs keyed by validity period instead of regenerating on every run"],"tags":["openssl","tls","certificate","http3","benchmark","setup"],"backgroundTag":null,"analyzedSha":"8c5296ac459e8252d3cd702f3fbcbb0c249d95d5","analyzedAt":"2026-08-16T08:01:58.794Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}